Amber — Phone-Capable Voice Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:55 PM UTC
• Version: 5.5.50

Overview

Amber’s phone-assistant purpose is coherent and mostly disclosed, but its outbound-call confirmation gate can be bypassed by a caller-supplied MCP flag, so it needs review before real use.

Review and patch the outbound-call workflow before enabling real calls: require server-side, single-use approval state bound to the exact phone number and objective, or set AMBER_ENABLE_OUTBOUND_CALLS=false until fixed. Use a dedicated Twilio subaccount, dedicated OpenAI project key, BRIDGE_API_TOKEN, strict webhook validation, and clear caller consent/retention rules for logs, contacts, CRM memory, and transcript enrichment. Update flagged dependencies before production deployment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: runtime/src/mcp-server.ts:343

Finding

Client-controlled confirmation flag allows outbound call safeguards to be bypassed

Content

View full analysis

`${c.firstName} ${c.lastName}`.toLowerCase().includes(q) || c.firstName?.toLowerCase().includes(q) || c.lastName?.toLowerCase().includes(q) || c.nickname?.toLowerCase().includes(q) ).filter((c: any) => c.phones?.length > 0 || c.phone); if (matches.length === 0) { return { content: [{ type: 'text', text: `No contact found named "${toName}" with a phone number.` }], isError: true }; } if (matches.length > 1) { const names = matches.map((c: any) => `${c.firstName} ${c.lastName}`.trim() + ` (${(c.phones?.[0]?.number || c.phone)})` ).join('\n'); return { content: [{ type: 'text', text: ...[truncated 5439 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (98)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · AGENT.md (reported line 1)May include surrounding context.

md

# AGENT.md — Voice Assistant Persona & Instructions

This file defines how the voice assistant behaves on calls. Edit this to customize
personality, conversational flow, booking rules, and greetings.

Template variables (auto-replaced at runtime):
- `{{ASSISTANT_NAME}}` — assistant's name (env: `ASSISTANT_NAME`)
- `{{OPERATOR_NAME}}` — operator/boss name (env: `OPERATOR_NAME`)
- `{{ORG_NAME}}` — organization name (env: `ORG_NAME`)
- `{{DEFAULT_CALENDAR}}` — calendar name for bookings (env: `DEFAULT_CALENDAR`)
- `{{CALENDAR_REF}}` — resolves to "the {calendar} calendar" or "the calendar"

---

## Securi

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · AMBER_SKILLS_SPEC.md (reported line 102)May include surrounding context.

md

//   context.exec(cmd)           — run allowed local binaries only
  //   context.callLog.write(entry) — append to call log
  //   context.gateway.post(payload) — POST to OpenClaw gateway (if permitted)
  //   context.gateway.sendMessage(message) — send message to operator via OpenClaw
  //   context.call.id              — current call ID
  //   context.call.callerId        — caller's phone number
  //   context.call.transcript      — current transcript

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · ASTERISK-IMPLEMENTATION-PLAN.md (reported line 250)May include surrounding context.

md

- [ ] Environment detection (has server? use Asterisk)
- [ ] Automated Asterisk installation script
- [ ] SIP trunk configuration helper
- [ ] Update SKILL.md with Asterisk instructions

**Week 6: Testing & Release**
- [ ] End-to-end testing (inbound + outbound)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Dynamic filesystem scanning and handler loading materially expand attack surface because any unauthorized or malicious skill directory/handler introduced on disk could be loaded into a privileged telephony environment. In a system with network, env, local file, and messaging permissions, plugin loading is dangerous unless tightly constrained and authenticated.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

Amber's skill system is designed to grow. Each skill is a self-contained directory with a `SKILL.md` (metadata + function schema) and a `handler.js`. You can:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

- **Dependency integrity:** runtime dependencies are pinned by `runtime/package-lock.json`; review dependency changes before publishing updates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md

- **Dependency integrity:** runtime dependencies are pinned by `runtime/package-lock.json`; review dependency changes before publishing updates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md

- Review `runtime/package.json` dependencies before deployment in regulated environments.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The script tells the user that a .env file containing configuration has been written to /tmp/demo/.env, a world-accessible temporary location on many systems. If real secrets are ever stored there, other local users, processes, backups, shell history workflows, or accidental commits could expose Twilio and OpenAI credentials.

Content

Scanner excerpt · demo/demo-wizard.js (reported line 134)May include surrounding context.

js

}

  // Generate
  head('Generating .env');
  await sleep(500);
  ok('.env written to /tmp/demo/.env');

Known Vulnerable Dependency: fast-uri==3.1.4 — 5 advisory(ies): CVE-2026-75931 (fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +2 more

High

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The lockfile includes fast-uri 3.1.4, which is flagged for multiple URI parsing issues including host confusion and SSRF-related edge cases. In this skill’s context, URI handling matters because it integrates network-facing components and MCP/HTTP tooling, so a vulnerable URL parser in the dependency tree could enable request target confusion or SSRF if attacker-controlled URLs are ever processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.2.0 — 3 advisory(ies): CVE-2026-54272 (ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSR); CVE-2026-69198 (ip-address: a CIDR suffix on the parsed address suppresses special-use classific); CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The lockfile includes ip-address 10.2.0, which is reported to mis-handle special or malformed IP forms in ways that can bypass SSRF protections. That is particularly relevant here because the stack includes express-rate-limit and other network-facing services; incorrect IP classification can weaken trust boundaries, proxy checks, or SSRF defenses around telephony and MCP-exposed endpoints.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · demo/demo-wizard.js (reported line 136)May include surrounding context.

js

// ── Helpers ──────────────────────────────────────────────────────────
const __dirname = dirname(fileURLToPath(import.meta.url));
const envPath   = resolve(__dirname, '.env');

let rl;
const ask = async (prompt, defaultVal) => {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/setup-wizard.js (reported line 31)May include surrounding context.

js

// ── Helpers ──────────────────────────────────────────────────────────
const __dirname = dirname(fileURLToPath(import.meta.url));
const envPath   = resolve(__dirname, '.env');

let rl;
const ask = async (prompt, defaultVal) => {

Static analysis

No suspicious patterns detected.