Pine Voice
v1.2.2Give your agent a real phone. It dials, waits on hold, negotiates your bills, and returns a full transcript.
⭐ 2· 535·0 current·0 all-time
by@bojieli
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (make phone calls, negotiate, return transcript) match the provided scripts and documented behavior. Required binary (node) and use of network APIs to 19pine.ai are proportional to the purpose; no unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md instructs the agent to ask the user for their Pine AI account email, run the provided auth and call scripts, and collect potentially sensitive call context (account numbers, payment info, etc.). That is expected for a negotiation/agent-calling service but broad: the agent is explicitly told to collect all information the callee might need (including authentication/payment details), and to spawn background sessions while calls run. These instructions grant the skill permission to transmit sensitive personal and account data to Pine's API.
Install Mechanism
No install spec; scripts are executed directly with node. No downloads or archive extraction. This is low-risk from an install perspective.
Credentials
No environment variables or external credentials are requested. The skill persists credentials to ~/.pine-voice/credentials.json (written with 0o600 permissions), which is proportional to the described auth flow. Be aware that saved access tokens permit the skill to call Pine's APIs on the user's behalf.
Persistence & Privilege
always is false and the skill does not modify other skills or system-wide settings. It writes only its own credentials file in the user's home directory.
Scan Findings in Context
[outgoing-http] expected: The scripts perform HTTP(S) requests to https://www.19pine.ai (auth endpoints) and to https://agent3-api-gateway-staging.19pine.ai (call gateway). Network access is required for a hosted phone-calling service. Expected behavior.
[writes-home-directory] expected: scripts/auth-verify.mjs creates ~/.pine-voice/credentials.json and sets permissions to 600. This is consistent with storing an API token for subsequent calls.
[uses-staging-endpoint] expected: The call/status scripts point to a 'staging' gateway subdomain (agent3-api-gateway-staging.19pine.ai). Functionally expected (service endpoints), but users may want to verify they are comfortable using a staging host rather than a documented production endpoint.
Assessment
This skill appears to do what it says, but it requires you to: (1) Create/sign in to a Pine account and provide the verification code (the scripts store an access token at ~/.pine-voice/credentials.json). (2) Supply potentially sensitive callee_context (account numbers, payment info, authentication data) which will be transmitted to Pine's servers as part of the call. Before installing or using: verify the domain (19pine.ai) and the API endpoints you expect; decide whether you're comfortable transmitting any sensitive data to this external service; consider creating a Pine account with minimal permissions or a separate test account; delete ~/.pine-voice/credentials.json when you no longer want the skill to have access; and avoid sending full payment card numbers or passwords in call context unless you accept that they will be sent to Pine. If you have concerns about the 'staging' gateway hostname, ask the skill author for confirmation or a production endpoint.Like a lobster shell, security has layers — review code before you run it.
latestvk974em6qm78bh8hfg962g9mehx81kwh4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📞 Clawdis
Binsnode