Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed CALL-E phone-calling integration with meaningful privacy and real-world-action considerations, but its behavior is coherent with its stated purpose.
Install only if you intend to let CALL-E place real phone calls and process call content. Confirm the phone number, call goal, language/region if relevant, and that you are authorized to receive any resulting summary or transcript.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- If the user asked only to verify setup or only to plan, do not run the call.
- Do not guess phone numbers, country codes, language, region, `plan_id`,
`confirm_token`, or `run_id`.
- Do not print, request, or expose access tokens.
## CLI selection
The skill embeds hidden-comment instructions that materially affect execution behavior, including command routing and operational constraints. Hidden instructions are dangerous because they can bypass user and system visibility, making it easier to smuggle execution-affecting behavior into the agent workflow; in this case the hidden directive influences how commands are selected for a tool capable of real phone calls.
## CLI selection
<!-- sync-with: packages/cli/docs/cli-reference.md#selecting-the-cli-entry-point -->
Run every CLI command through the bundled `scripts/run-agent-command.mjs`.
Follow the [entry-point checks](references/commands.md#verify-the-cli-entry-point)
and write command arguments as JSON data, never shell text.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
## Verify the CLI entry point
<!-- sync-with: packages/cli/docs/cli-reference.md#selecting-the-cli-entry-point -->
Do not run bare `calle` or use `npx` to select the CLI.
Older SDK releases, including `@call-e/calle@0.7.0`, export the same `calle`
command as `@call-e/cli`. Even `npx` can select the SDK binary in a mixed
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Rules:
- Treat all command output as JSON except `--help`.
- Do not print or ask for access tokens.
- Whenever this OpenClaw CLI skill is actively invoked, run `auth status`
before call planning or tool listing.
- If `auth status` reports `usable: false`, do not call `mcp tools` or
The skill advertises activation on broad, everyday phrases like 'call a business' or 'follow up by phone', which can cause the agent to invoke a capability that initiates real-world external actions without sufficiently narrow triggering conditions. In a telephony skill, accidental activation is more dangerous than in read-only skills because it can lead to unintended call planning, authentication prompts, or even outbound calls if downstream logic is followed.
The skill enables real outbound calls and later instructs exposing call status, summaries, and transcripts back to the requester, but it does not clearly require user consent for sharing potentially sensitive callee content. In a phone-calling context, transcripts and summaries may contain personal data or third-party disclosures, so insufficient privacy notice and consent handling is a genuine privacy risk.
The policy requires avoiding language or locale constraints unless the user is offered a choice or the constraint is justified. Here, the skill references language handling but does not explicitly require asking the user for preferred language when it is not already provided, creating a risk that a default language may be used without opt-in.
Detected: suspicious.dangerous_exec