Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Never store API keys in `SKILL.md`, examples, references, or memory/state files.
Security audit
Openclaw phone
Security checks for vulnerabilities and agentic risk
Overview
This phone-call skill is sensitive but coherent: it requires confirmation before calls and does not add hidden persistence or background jobs.
Install this only if you want an agent to manage CallMyCall phone calls. Check phone numbers, caller ID, call goals, recordings, transcripts, and any personal data before confirming; recordings and transcripts may contain sensitive information and may require consent or retention controls. Keep the API key in an environment variable or user config, and avoid optional webhooks or PII fields unless you have a clear need and trust the destination.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 2. `~/.openclaw/openclaw.json` at `skills.openclaw-phone.apiKey` 3. One-time user prompt for current task only This skill does not write config files automatically. If you want persistence, add the key manually to `~/.openclaw/openclaw.json`. The skill must not store API keys in skill source files or memory/state files.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description uses broad trigger phrases like 'call someone,' 'plan a future call,' and 'fetch call results,' which overlap with ordinary conversational requests. In an agent environment, this can cause overbroad invocation and unintended activation for ambiguous user messages, leading the agent to initiate or prepare telephony actions the user did not clearly intend.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md When the key is provided interactively: - Use it for the current task only. - Do not auto-write to config. - If the user wants persistence, provide manual config instructions: - Store at `skills.openclaw-phone.apiKey` in `~/.openclaw/openclaw.json`.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file instructs the skill to resolve an API key from
CALLMYCALL_API_KEYand a local config file, which is sensitive credential access. The examples do not include any warning or disclosure to the user that the skill may read credentials from environment variables or local configuration.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown describes a
recordoption that enables recording calls, which can affect user privacy and create sensitive stored data. There is no accompanying warning or disclosure in the documentation about consent, privacy implications, or handling of recorded content.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The
personaobject includes highly sensitive fields such aspersonal_security_numberand address, but the documentation provides no warning about sensitivity, minimization, or secure handling. For markdown files, omission of warnings around behaviors affecting privacy or user data is in scope.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The API reference allows specifying a
webhookandwebhook_events, which implies transmission of call-related data to a third-party endpoint. The documentation does not warn users that event payloads may contain sensitive call metadata or transcripts and leave the primary system boundary.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The transcript streaming endpoint provides live call transcripts, which may expose sensitive conversational content. The markdown does not include any warning about privacy, access control, or appropriate handling of streamed transcript data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The recording endpoint returns a recording URL for a call, which can expose sensitive audio content. The documentation omits a warning that recordings may contain personal or confidential information and require careful access control.
- Content