voice-agent-memory

• Outcome: Review
• Latest audit: Aug 1, 2026 · 1:49 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent phone-memory purpose, but it stores and recalls caller data automatically while exposing sensitive bridge functions without effective authentication.

Install only after tightening access control: require real bearer-token validation on every sensitive endpoint, restrict CORS, avoid exposing the bridge publicly until authenticated, add caller notice and consent for recording/transcription/memory, define retention and deletion controls, and use scoped secrets rather than broadly loading .env files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented behavior materially overstates and misrepresents what the skill does, including claims around telephony, transcription, and authentication. Most importantly, if the implementation accepts any auth token and only logs invalid tokens instead of rejecting requests, unauthorized parties could interact with the bridge, access memory-backed context, or trigger storage/logging paths.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The /calls/history endpoint returns recent call metadata without any authentication or authorization checks. In a voice-memory system, call history is highly sensitive because it can expose caller identities, timestamps, durations, and usage details, enabling privacy violations and reconnaissance about who contacted the service.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The authentication helper logs invalid bearer tokens but explicitly accepts them anyway and returns a fallback identity. Because the main request path calls verify_token() but does not enforce success, any remote party can invoke the bridge, access memory-backed behavior, trigger third-party API usage, and cause transcript retention without valid credentials.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The architecture explicitly describes automatic recall of prior caller data and automatic transcript storage tied to caller ID, but it provides no indication of consent, notice, retention limits, or access controls. In a voice/telephony context, this creates meaningful privacy and compliance risk because callers may disclose sensitive personal or financial information during calls and have it persistently stored and reused across future interactions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes automatic transcription, storage, and recall of phone conversations tied to caller identity without any visible notice, consent flow, retention limit, or privacy warning. In a voice-call context this increases legal, compliance, and privacy risk because callers may disclose sensitive information that is persistently stored and reused across future interactions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented outbound-calling feature enables initiating live calls to third parties without any warning about consent, authorization, abuse prevention, or call-compliance obligations. In practice this could be used for unsolicited or impersonated calls, especially when paired with persistent caller context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code sends call transcripts and caller identifiers to an external service, which can include highly sensitive personal data, without any evidence in this file of consent, minimization, or policy enforcement. In a voice-agent memory skill, this creates meaningful privacy and compliance risk because whole conversations are persisted off-platform and linked to identifiable callers.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function performs pre-call recall by sending caller-derived identifiers and contact names to an external memory service before the agent speaks. That leaks metadata about the caller and can expose prior relationship history or PII to a third party without an apparent notice or consent check in this code path.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Mid-call notes are transmitted to an external service and may contain ad hoc sensitive observations learned during the conversation. Because this occurs during a live call, operators may unintentionally exfiltrate especially sensitive details in real time without user awareness or review.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code injects caller identity, role, and recalled cross-call memory directly into the system prompt, which can expose personal or sensitive data to the model and shape responses using stored information without any visible consent, minimization, or sanitization controls in this component. In a voice-agent context that explicitly persists memory across calls, this increases privacy risk and the chance of inappropriate disclosure if memory contains sensitive details or prompt-manipulating content.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill is intentionally designed to retain and reuse caller-linked conversation history, which creates a real privacy and data-protection risk even if it is part of the product goal. Because the memory is persistent and identity-linked, misuse or compromise could expose sensitive personal information across calls or to administrators with filesystem/API access.

Ssd 3

High

• Confidence: 95% confidence
• Finding: Automatically transcribing, storing, and later recalling all call content tied to a caller number creates a high-risk repository of sensitive communications. In a phone-support context, callers may reveal financial, medical, account, or personal details, so broad automatic retention substantially increases the harm from unauthorized access, prompt injection through stored content, or excessive internal reuse.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: Caller-based memory isolation and personalized reuse are core features, but they still create a real risk of profiling and over-collection of personal data. The context makes the issue more dangerous because voice interactions are identity-linked by phone number, making cross-session tracking easy and potentially difficult for callers to understand or control.

Ssd 3

High

• Confidence: 94% confidence
• Finding: The examples explicitly encourage storing full transcripts or summaries and mid-call notes about caller preferences, which can include sensitive personal attributes and behavioral profiles. This is particularly risky because the examples normalize broad collection without safeguards, making insecure deployments more likely.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The prompt explicitly tells the agent to remember what the caller says and states it will be stored after the call, encouraging broad retention of potentially sensitive user-provided information. In a phone-call setting, users may disclose personal, financial, health, or confidential business details, so indiscriminate retention raises privacy, compliance, and secondary disclosure risks.

Ssd 3

High

• Confidence: 93% confidence
• Finding: System-message content from the upstream request is concatenated into system instructions and then combined with recalled caller memory, with no trust boundary or filtering. An attacker controlling or influencing those system fields can inject instructions that cause the model to reveal prior-call memory or manipulate how sensitive recalled context is used, which is especially dangerous in a cross-call memory product.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "🔍 Recalling BlueColumn memory for caller: $PHONE"
echo ""

curl -s -X POST "https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-recall" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \
  -d "{\"q\": \"What do I know about caller $PHONE?\"}" | python3 -c "

• Confidence: 86% confidence
• Finding: curl -s -X POST "https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-recall" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \ -d

Credential Access

High

• Category: Privilege Escalation

Content

- "https://api.anthropic.com"
  files:
    read:
      - "~/.openclaw/workspace/skills/voice-agent-memory/.env"
      - "~/.openclaw/workspace/skills/voice-agent-memory/contacts.json"
      - "~/.openclaw/workspace/memory/voice-calls/"
    write:

• Confidence: 87% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"

# Load .env
if [ -f "$SCRIPT_DIR/.env" ]; then
    export $(grep -v '^#' "$SCRIPT_DIR/.env" | xargs)
fi

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"

# Load .env
if [ -f "$SCRIPT_DIR/.env" ]; then
    export $(grep -v '^#' "$SCRIPT_DIR/.env" | xargs)
fi

• Confidence: 95% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

# Load .env
if [ -f "$SCRIPT_DIR/.env" ]; then
    export $(grep -v '^#' "$SCRIPT_DIR/.env" | xargs)
fi

MESSAGE="${1:-Hello, this is Joe calling about BlueColumn.}"

• Confidence: 97% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

# Load API key from .env
SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
if [ -f "$SCRIPT_DIR/.env" ]; then
    export $(grep -v '^#' "$SCRIPT_DIR/.env" | xargs)
fi

• Confidence: 80% confidence
• Finding: .env"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.110.0
uvicorn>=0.27.0
httpx>=0.27.0
anthropic>=0.30.0

• Confidence: 92% confidence
• Finding: fastapi>=0.110.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.110.0
uvicorn>=0.27.0
httpx>=0.27.0
anthropic>=0.30.0
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: uvicorn>=0.27.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.110.0
uvicorn>=0.27.0
httpx>=0.27.0
anthropic>=0.30.0
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: httpx>=0.27.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.