Ae1
High
- Category
- analysis-evasion
- Content
- Never store API keys in `SKILL.md`, examples, references, or memory/state files.
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
Openclaw phone
Security checks for vulnerabilities and agentic risk
Overview
This phone-call skill is sensitive but coherent: it requires confirmation before calls and does not add hidden persistence or background jobs.
Install this only if you want an agent to manage CallMyCall phone calls. Check phone numbers, caller ID, call goals, recordings, transcripts, and any personal data before confirming; recordings and transcripts may contain sensitive information and may require consent or retention controls. Keep the API key in an environment variable or user config, and avoid optional webhooks or PII fields unless you have a clear need and trust the destination.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Session Persistence
Medium
- Category
- Rogue Agent
- Content
2. `~/.openclaw/openclaw.json` at `skills.openclaw-phone.apiKey` 3. One-time user prompt for current task only This skill does not write config files automatically. If you want persistence, add the key manually to `~/.openclaw/openclaw.json`. The skill must not store API keys in skill source files or memory/state files.
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Vague Triggers
Medium
- Confidence
- 94% confidence
- Finding
- The skill description uses broad trigger phrases like 'call someone,' 'plan a future call,' and 'fetch call results,' which overlap with ordinary conversational requests. In an agent environment, this can cause overbroad invocation and unintended activation for ambiguous user messages, leading the agent to initiate or prepare telephony actions the user did not clearly intend.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
When the key is provided interactively: - Use it for the current task only. - Do not auto-write to config. - If the user wants persistence, provide manual config instructions: - Store at `skills.openclaw-phone.apiKey` in `~/.openclaw/openclaw.json`.
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Missing User Warnings
Medium
- Confidence
- 92% confidence
- Finding
- This markdown file instructs the skill to resolve an API key from `CALLMYCALL_API_KEY` and a local config file, which is sensitive credential access. The examples do not include any warning or disclosure to the user that the skill may read credentials from environment variables or local configuration.
Missing User Warnings
Medium
- Confidence
- 89% confidence
- Finding
- The markdown describes a `record` option that enables recording calls, which can affect user privacy and create sensitive stored data. There is no accompanying warning or disclosure in the documentation about consent, privacy implications, or handling of recorded content.
Missing User Warnings
Medium
- Confidence
- 92% confidence
- Finding
- The `persona` object includes highly sensitive fields such as `personal_security_number` and address, but the documentation provides no warning about sensitivity, minimization, or secure handling. For markdown files, omission of warnings around behaviors affecting privacy or user data is in scope.
Missing User Warnings
Medium
- Confidence
- 84% confidence
- Finding
- The API reference allows specifying a `webhook` and `webhook_events`, which implies transmission of call-related data to a third-party endpoint. The documentation does not warn users that event payloads may contain sensitive call metadata or transcripts and leave the primary system boundary.
Missing User Warnings
Medium
- Confidence
- 86% confidence
- Finding
- The transcript streaming endpoint provides live call transcripts, which may expose sensitive conversational content. The markdown does not include any warning about privacy, access control, or appropriate handling of streamed transcript data.
Missing User Warnings
Medium
- Confidence
- 85% confidence
- Finding
- The recording endpoint returns a recording URL for a call, which can expose sensitive audio content. The documentation omits a warning that recordings may contain personal or confidential information and require careful access control.
Static analysis
No suspicious patterns detected.