Amber — Phone-Capable Voice Agent

• Outcome: Review
• Latest audit: Jun 18, 2026 · 9:03 PM UTC
• Version: 5.5.39

Overview

Amber is a mostly transparent phone-agent integration, but it needs Review because it automatically retains and enriches caller data while exposing sensitive calling, CRM, calendar, contacts, and transcript access.

Install only if you are prepared to operate Amber as a sensitive communications system: use dedicated Twilio/OpenAI credentials, protect runtime/.env, disclose AI call handling and logging to callers where required, limit Apple Contacts export to names and phone numbers unless needed, review/delete CRM and call-log data manually, and keep bridge/dashboard/MCP access restricted to trusted local users.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The spec repeatedly claims router-level confirmation is enforced programmatically for side-effecting skills, but the documented `send_message` function schema lacks a `confirmed` parameter while the handler immediately logs and delivers the message. In practice this creates a gap where a model or caller can trigger message delivery without an explicit confirmed flag, undermining the claimed safety control for an external action.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The spec says the loader checks `SKILL_MANIFEST.json` before loading any handler, but the implementation section later instructs the loader to scan subdirectories, parse manifests, and require handlers directly. If implemented as described, unapproved or dropped-in skill directories could be loaded and executed, defeating the stated allowlist control and expanding the trusted code surface.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file presented as the manifest for the 'amber-voice-assistant' skill is instead a global allowlist that does not include that skill at all. This mismatch is dangerous because it can cause the security/review system and runtime behavior to diverge: the reviewed skill metadata suggests phone-call capability, while the actual loaded skills are a different set, enabling configuration confusion, unauthorized skill substitution, or bypass of expected deployment controls.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements calendar lookup and event creation even though the skill metadata describes phone capabilities. This scope mismatch is dangerous because it grants access to sensitive calendar data and modification ability that users and reviewers would not reasonably expect from a phone-oriented skill, increasing the chance of covert data access or unauthorized actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill can read availability and create calendar events, capabilities that are not justified by the stated phone-assistant function. Even though the code attempts to redact event details on lookup, it still exposes schedule intelligence and allows state-changing calendar writes, which can leak private routines or alter the operator's schedule without appropriately scoped authorization.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The design document makes contradictory security claims: it says there is 'No network exposure' and that external adapters are not part of MVP, yet it also specifies dynamic adapter loading and network-based push/pull sync behavior. This creates a real risk of operators or implementers relying on inaccurate trust boundaries, causing a skill to be deployed with weaker controls than expected.

Scope Creep

High

• Confidence: 97% confidence
• Finding: The manifest declares `permissions.network: false`, but the design later defines external CRM adapter sync and lookup flows that inherently require outbound network access. If implemented inconsistently, this can lead to undeclared capability expansion, permission bypass assumptions, or unsafe later changes where networked data exfiltration is added without updating the security model.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The wizard explicitly says it is a mock demo that does not verify credentials, yet it prints success messages for credential validation, ngrok detection, dependency installation, build completion, and .env generation that are not actually performed. This can mislead users into trusting a broken or insecure setup, causing secrets to be entered into an unreliable flow and security controls to be assumed present when they are not.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The runtime automatically performs transcript-based CRM enrichment after calls, extracting caller identity, company, notes, and summaries, then persists them via the CRM skill. That exceeds the stated phone-call/task scope and creates a real privacy and data-minimization risk because sensitive call content is retained and profiled without any evident consent or purpose limitation enforcement in this code path.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The server advertises itself as a phone capability adapter, but it also exposes calendar management, CRM access, and Apple Contacts retrieval. This kind of scope mismatch is dangerous because users and downstream agents may grant trust or permissions based on the manifest description while the implementation can access and disclose substantially broader personal data.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The contacts_lookup tool reads a local exported Apple Contacts cache and returns rich personal data including phone numbers, emails, relationships, addresses, and notes. In the context of a voice assistant skill, this creates a clear privacy and data-exposure risk because an agent using the skill can enumerate or exfiltrate sensitive contact information beyond what is necessary to place calls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The plan explicitly describes receiving RTP audio from callers, forwarding it to OpenAI over WebSocket, and returning generated audio, but it does not pair that flow with any user-facing notice, consent step, or privacy guidance. For a phone assistant, this means live caller audio may be transmitted to third-party services without informed consent, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persistently stores contact records, including phone numbers, names, email addresses, company data, and context notes, into a local SQLite database without any evidence in this file of notice, consent, or retention controls. In a voice-assistant/phone context, silently creating a durable contact database from call-derived data can violate user expectations and privacy requirements, especially when the system may process third-party caller information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The interaction logger stores persistent summaries, outcomes, arbitrary JSON details, call direction, and call SID for phone interactions without any indication here that the caller or user is warned about storage and retention. Because summaries and details may contain sensitive call content or personal data, silent retention increases privacy, compliance, and data-exposure risk if the host is shared, compromised, or improperly managed.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README explicitly instructs users to sync Apple Contacts to a local cache, but does not clearly warn that this may copy personally identifiable information from a system address book into local plugin-managed storage. In a voice/telephony skill, that data can include sensitive names, numbers, and relationship context, so the omission increases the risk of users enabling data collection and retention without informed consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes voicemail, call history, transcripts, and AI summaries, but does not clearly disclose that calls and messages may be recorded, transcribed, and processed by AI services, potentially involving sensitive personal or business communications. In a telephony plugin, this is especially risky because users may deploy it in jurisdictions with consent requirements, and callers may not expect retention or third-party processing of their conversations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This command explicitly exposes highly sensitive communications data including phone numbers, call history, transcripts, and AI-generated summaries, but the skill documentation provides no warning, consent prompt, or indication of access controls. In a cowork/agent environment, this increases the risk of accidental disclosure of personal or business-sensitive information to users who may not realize the breadth of data returned.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The command explicitly describes collecting personally identifiable and potentially sensitive information from callers, including names, callback numbers, messages, and optionally calendar availability, but provides no privacy notice, consent guidance, retention limits, or handling restrictions. In a phone-screening context, this omission can lead to improper collection, storage, or sharing of personal data and create compliance and trust risks for both the user and callers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly collects caller identity, callback numbers, messages, performs CRM enrichment, and sends structured summaries, but the user-facing description does not mention privacy implications, retention, consent, or where this data is sent and stored. In a phone-screening context, this omission can lead to uninformed collection and downstream disclosure of personal data, increasing legal, compliance, and trust risks.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill description presents contact memory and conversation logging as a feature but does not clearly warn users that personal data and every conversation will be automatically stored. In a voice-assistant/telephony context, this can lead to undisclosed collection of sensitive personal information, creating privacy, consent, and compliance risks for both callers and operators.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The automatic lookup, enrichment, post-call logging, and auto-creation of new caller records describe privacy-sensitive processing without any user-facing consent or warning. Because this skill operates on inbound calls and preserves summaries, sentiment, and outcomes, it increases the risk of covert profiling, unauthorized retention of personal data, and regulatory violations in jurisdictions requiring notice and consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The architecture explicitly requires logging call IDs, timestamps, and major tool events, but it does not mention user notice, consent, retention limits, minimization, or access controls for this call metadata. In a telephony assistant, those logs can reveal sensitive communication patterns and interactions with backend tools, creating privacy, compliance, and insider-misuse risks if collected without clear safeguards.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly promotes automatic call transcription and storage of call logs in local files but does not warn operators about consent, sensitive data capture, or retention obligations. In a phone assistant context, this can lead to unintentional collection of highly sensitive caller information and legal/privacy noncompliance, especially for two-party consent jurisdictions or regulated data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The OpenClaw integration description explains that live caller questions are forwarded to another agent/service with access to tools and personal context, but it does not warn that caller content and operator context may be transmitted beyond the voice bridge. This creates a material privacy and data-sharing risk because users may not expect their phone conversation contents to be sent to an additional backend with broader access to calendars, contacts, memory, or other personal data.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The telephony runtime configuration sets `webhookSecret` to `VOICE_WEBHOOK_SECRET` or, if absent, falls back to the Twilio auth token (`credential`). Reusing a provider API credential as a webhook verification secret weakens secret separation and can increase blast radius: compromise or disclosure of one secret may enable abuse of both API access and webhook trust decisions.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

No suspicious patterns detected.