T09 · Insecure Skill Coding Practices
Error
- Location
listener/clawcall-listener.js:217- Finding
Caller-Controlled Command Injection Through Windows Shell Invocation
- Content
View full analysis
- Remediation
View remediation
Security audit
clawcall-phone
Security checks for vulnerabilities and agentic risk
Overview
This phone-call skill matches its stated purpose, but it needs Review because it handles real phone calls and sensitive local agent context with weak authorization and serious Windows command-execution risk.
Review carefully before installing. Use it only if you are comfortable sharing phone numbers, call transcripts, schedule/context data, and possible local agent context with ClawCall. Keep the bridge bound to 127.0.0.1, do not expose port 4747, protect CLAWCALL_API_KEY, avoid Windows runtime until shell invocation is fixed, and require explicit approval for third-party calls, recurring calls, callbacks, account recovery, voice changes, and any crypto billing step.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
bridge/phone-agent-server.js:67- Finding
Model Prompt Passed Through a Windows Command Shell
- Content
View full analysis
{ const args = ["infer", "model", "run", MODEL_MODE === "local" ? "--local" : "--gateway", "--json", "--prompt", prompt]; if (MODEL) args.splice(4, 0, "--model", MODEL); if (process.platform === "win32") { const child = spawn("openclaw", args, { shell: true, windowsHide: true, stdio: ["ignore", "pipe", "pipe"], }); ``` ```js const context = await buildPhoneContext(message); const prompt = buildPhonePrompt({ identity: context.identity, user: context.user, contextText: context.contextText, message, }); try { const reply = await runModel(prompt); ``` ### Technical Analysis The generated `prompt` includes the caller-controlled `message`. On Windows, the entire prompt is supplied as a command-line argument to a process created with `shell: true`. Although the input is intended to be an argument to `--prompt`, shell-backed process creation creates a command interpretation boundary. Shell-special characters in the prompt may escape the expected argument context and be interpreted as additional commands or redirections. The prompt can also contain values read from local profile or memory files. Those files therefore constitute an additional untrusted-input source if another process or user can modify the workspace. ### Attack Path 1. An attacker submits a crafted message to `/clawcall/message` or causes a crafted call transcript to reach the bridge. 2. `buildPhonePrompt` embeds the attacker-controlled message into `prompt`. 3. `runModel` places that prompt in the OpenClaw command arguments. 4. On Windows, `spawn` executes the command using a shell. 5. The shell interprets command metacharacters contained in ...[truncated 614 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bridge/phone-agent-server.js:191- Finding
Unauthenticated Bridge Endpoint Exposes Private Agent Context
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
bridge/phone-prompt.js:3- Finding
Prompt Injection Can Target Private Memory Included in Model Context
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bridge/phone-agent-server.js:145- Finding
Missing Caller-Level Authorization for Task and Cron Information
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
listener/clawcall-listener.js:258- Finding
Sensitive Call Transcripts and Responses Logged in Plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description promises a phone integration that can receive calls and also initiate or schedule calls on the user's behalf. The code only provides a lightweight local bridge server that responds to POSTed message payloads with text responses. It includes health checking, basic canned replies, cron/task summaries, and model-backed conversation generation, but there is no code for telephony APIs, dialing, callback workflows, scheduled outbound calls, or calling third parties. While the endpoint may support an external phone system, the implemented capability in this chunk is materially narrower than the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a telephony skill with real-number calling behavior. This code does something materially different: it gathers contextual data from local markdown files and CLI commands to assemble a phone-context summary. While the context may support a phone agent, this chunk alone does not perform the declared core capabilities. It also accesses local workspace files and OpenClaw task/cron data, which are not reflected in the description. Therefore the description does not accurately represent the behavior of the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description promises a telephony skill with real call-related capabilities. The actual code is limited to prompt construction for conversational behavior during a phone interaction. While this may be a supporting component of a phone agent, the provided chunk does not perform the core declared functions and instead serves only as response-formatting/prompting logic. That is a material difference in primary behavior versus the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code clearly supports one subset of the description: handling inbound calls/messages via ClawCall and routing them to an agent, then returning a reply. However, the declared description promises broader telephony capabilities—callbacks on task completion, scheduled calls, and calling third parties—that are not present in this code chunk. The code only listens for inbound call events (
/api/v1/calls/listen) and responds on the same call (/api/v1/calls/respond/{call_sid}). There is no logic for initiating outbound calls, scheduling, contact management, or task-completion-triggered dialing. Therefore the description materially overstates what this code actually does.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest explicitly enables autonomous calls to third parties and scheduled or callback behavior, yet it provides no warning about privacy implications, automated outbound contact, consent requirements, or the handling of personal phone data. Because telephony actions directly affect external people and can expose sensitive information or create harassment, spam, compliance, and trust risks, the missing warnings and constraints materially increase the danger of misuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares required environment variables and clearly expects networked/runtime capabilities, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host may permit broader execution or secret access than reviewers expect, especially since the skill handles an API key, phone numbers, and outbound communications.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The registration flow sends the user's phone number and agent identity to an external service. External transmission is expected for telephony, but it is still security-relevant because it exports personal data and establishes an account with a third party that will handle communications metadata.
- Content
- Call the registration endpoint:
text POST https://api.clawcall.online/api/v1/register Content-Type: application/json {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Polling the external listen endpoint transmits the API key and retrieves user call content from a third-party service. Because this endpoint carries both authentication material and potentially sensitive speech transcripts, compromise or misuse could expose private conversations.
- Content
for incoming messages manually:
text GET https://api.clawcall.online/api/v1/calls/listen?timeout=25 Authorization: Bearer {CLAWCALL_API_KEY}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Submitting call responses to the external API sends conversation content off-host and uses bearer-token authentication. In this context, even normal operation can expose sensitive user data if logs, proxies, or the remote service are mishandled.
- Content
After receiving a message, submit your response:
text POST https://api.clawcall.online/api/v1/calls/respond/{call_sid} Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The callback endpoint causes the service to place an outbound phone call containing agent-generated content. This is an external transmission of potentially sensitive task results and can create privacy or social-engineering risk if the message content is not constrained.
- Content
When a background task finishes and you need to notify the user by phone:
text POST https://api.clawcall.online/api/v1/calls/outbound/callback Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Scheduling recurring calls sends task context and timing information to an external provider. That can reveal routines, work patterns, and personal scheduling data, which is particularly sensitive in a phone-assistant context.
- Content
Scheduling a Recurring Call (Pro tier)
text POST https://api.clawcall.online/api/v1/calls/schedule Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The delete schedule endpoint is another authenticated external action. While less sensitive than message content, misuse could disrupt user workflows by canceling scheduled calls via a bearer token.
- Content
md Common patterns: every weekday 8am `"0 8 * * 1-5"` · daily 9am `"0 9 * * *"`. To cancel: `DELETE https://api.clawcall.online/api/v1/calls/schedule/{id}` **Requires Pro tier.**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill enables autonomous third-party phone calls and relays the conversation back to the agent, but it does not require warnings or consent checks about call recording, disclosure, privacy, or jurisdiction-specific laws. In a telephony context this is materially riskier because the agent may impersonate the user, share personal details, or create compliance exposure without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The third-party outbound calling endpoint transmits a target phone number, an objective, and contextual information to an external service so it can autonomously contact another person. In this skill context, that is especially dangerous because it can disclose personal data, enable impersonation, and trigger legal or reputational harm through unsupervised real-world communications.
- Content
Calling a Third Party (Pro tier)
text POST https://api.clawcall.online/api/v1/calls/outbound/third-party Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
Querying the account endpoint sends authentication to a third party and retrieves usage/account data. This is a normal external call, but exposure of account metadata can still aid profiling or abuse if credentials leak.
- Content
Account & Usage
text GET https://api.clawcall.online/api/v1/account Authorization: Bearer {CLAWCALL_API_KEY}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Changing voice settings is a lower-risk external transmission, but it still relies on bearer-token authenticated remote state change. Unauthorized use could alter user experience or indicate broader credential misuse.
- Content
Changing Voice
text POST https://api.clawcall.online/api/v1/account/voice Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Including a cryptocurrency billing workflow in a phone-enablement skill expands the attack surface into financial operations that are unrelated to the core task. That creates phishing and misdirection risk, especially because users may be prompted to retrieve a wallet address and send irreversible USDC payments through the same agent workflow.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The billing checkout endpoint initiates a crypto payment workflow with an external service, exposing the user to financial loss if the workflow is spoofed, tampered with, or initiated unexpectedly. Because crypto transfers are typically irreversible, the risk is materially higher than ordinary account-management traffic.
- Content
Step 1 — Get payment address and amount:
text POST https://api.clawcall.online/api/v1/billing/checkout Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Submitting a transaction signature to verify payment is another sensitive financial transmission to a third party. If abused, it could confirm unintended purchases or facilitate scams around fake upgrade flows.
- Content
Step 3 — Submit transaction signature to confirm:
text POST https://api.clawcall.online/api/v1/billing/verify Authorization: Bearer {CLAWCALL_API_KEY} Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The recovery flow re-registers using email and phone number to rotate the API key, transmitting sensitive identity data to an external service. If triggered incorrectly or by a malicious prompt, it could rotate credentials unexpectedly and disrupt service or enable account takeover attempts.
- Content
Re-register with the same email to rotate the key:
text POST https://api.clawcall.online/api/v1/register Content-Type: application/json {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code assembles personally sensitive context from IDENTITY.md, USER.md, and optionally MEMORY.md into a phone-facing context blob without any consent check, minimization guard, or indication in this file that the user approved disclosure for a call workflow. In a telephony skill, that context may be spoken over calls or sent to third parties, which increases the risk of privacy leakage beyond the local agent environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description advertises very broad call-related capabilities such as receiving calls, calling users back, running scheduled briefings, and placing autonomous calls, but it does not define clear trigger boundaries, authorization checks, or user-consent constraints. In a phone/voice skill, ambiguous activation language is risky because it can normalize unsolicited outbound actions and make it easier for downstream instructions or integrations to invoke calls in unintended contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Inbound caller speech/text is forwarded to another processing component via the configured agent webhook, but the code provides no caller notice, consent mechanism, or policy guard before transmitting potentially sensitive call content. In a telephony context, callers may reasonably disclose personal or confidential information, so silent forwarding to a local or remote service creates a meaningful privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Caller messages are handed to the OpenClaw CLI for downstream processing without any explicit warning to the caller that their content will be processed by external agent software. Even though this is a local subprocess rather than an HTTP webhook, it still expands the trust boundary and can expose sensitive caller data to additional tooling, logs, plugins, or model backends behind the CLI.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1 — Poll for incoming messages
text GET https://api.clawcall.online/api/v1/calls/listen?timeout=25 Authorization: Bearer {CLAWCALL_API_KEY}
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bridge/phone-agent-server.js:82
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bridge/phone-context.js:31
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- listener/clawcall-listener.js:170