Security audit

ClawCall

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it stores and reuses a phone-call credential and the user’s phone number with limited consent and safety controls.

Install only if you are comfortable with this skill placing real calls through ClawCall, sending call details to that service, and storing a reusable API key plus your phone number locally. Prefer using it in a single-user environment, review or delete ~/.config/clawcall/key.json when needed, and confirm numbers and approval boundaries before calls involving money, accounts, health, travel, or identity verification.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to persist a ClawCall API key and the user's phone number in `~/.config/clawcall/key.json` without any stated requirement for user consent, encryption, permission hardening, or retention limits. Local disk storage of reusable credentials increases the chance of credential theft, account misuse, and privacy leakage, especially on shared hosts or multi-tenant agent environments.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The scenario explicitly instructs persisting a user's callback or reservation phone number for future calls, but it does not require notice, consent, retention limits, or controls on later reuse. In a calling skill, phone numbers are personal contact data, and silent persistence can create privacy, compliance, and trust risks if the number is reused unexpectedly or exposed through logs, prompts, or future actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This scenario directs the system to use a previously saved phone number as the default during live handoff and to persist newly collected numbers, again without requiring fresh notice or confirmation. Because live handoff can involve sensitive contexts such as fraud support, automatic reuse of stored contact information raises the risk of privacy violations, misdialing, and unintended disclosure if the saved number is outdated, shared, or belongs to the wrong person.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs persistent storage of an API key and the user's phone number in a local config file or host secret store, and to save both immediately, but it does not require an explicit user consent or warning step before doing so. Because the same data is then reused automatically for future calls, callbacks, handoffs, and account-linking flows, unauthorized local access, cross-user environment reuse, or silent retention beyond user expectations could expose sensitive contact data and session-linked account access.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The contract exposes highly sensitive call artifacts such as full transcripts and recording URLs, but provides no privacy, consent, retention, or secure-handling guidance. In a phone-calling skill, these fields can contain personal data, account details, or regulated communications, so omitting warnings and handling requirements increases the risk of accidental overcollection, unsafe display, or disclosure.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The API documents a destructive reset operation that clears global call preferences without emphasizing the user impact or need for confirmation. In an agent-driven integration, this increases the chance of accidental configuration loss or unintended service changes if the endpoint is invoked based on ambiguous user intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example includes a full date of birth in cleartext as part of call instructions, which is sensitive personal data and can normalize unsafe handling of identity-verification information. Even though this appears to be illustrative documentation rather than active exfiltration, skills like this directly facilitate real-world phone interactions, so exposing or encouraging transmission of DOB without an adjacent warning increases privacy and social-engineering risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guidance explicitly tells the agent to persist a newly provided handoff number as `user_phone_number` unless the user opts out, but it does not require a clear warning or consent flow for storing personal contact data. In a phone-agent skill, this increases privacy risk because users may supply a number for a narrow operational purpose and not realize it will be retained for future use.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly directs the agent to persist the user's phone number in state or a host secret store for reuse, but it does not require clear user notice, consent, retention limits, or deletion controls. Because phone numbers are personal data and are later reused for callbacks or live handoff, this creates a privacy risk of silent long-term storage, stale-number misuse, or disclosure to the wrong party.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs sending detailed call instructions to a third-party calling service, including potentially sensitive data such as names, dates of birth, account numbers, insurance details, reservation data, and callback numbers, without a clear warning that this information will be transmitted off-platform. In this context, the agent is encouraged to compile rich personal context for real-world calls, which increases the risk of unnecessary data sharing, overcollection, and exposure if the provider, logs, transcripts, or recordings are accessed improperly.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.