ClawHub
Back to skill

Security audit

Vapi Skill

Security checks for vulnerabilities and agentic risk

Overview

This Vapi skill is mostly purpose-aligned, but it tells users to run an unverified remote installer directly in Bash for an optional CLI.

Review before installing. The REST/API portion is coherent for managing Vapi resources, but avoid running the provided `curl | bash` CLI installer unless you independently verify Vapi's installer source and understand what it changes locally. Also confirm any assistant, model, voice, phone-number, webhook, or outbound-call changes because they can affect billing, privacy, and real-world telephony behavior.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:85
Finding

Unverified Remote Installer Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 85
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -sSL https://vapi.ai/install.sh | bash

Technical Analysis

The installation command downloads a mutable script from an external URL and immediately executes it with Bash. The script is not pinned to a reviewed version, downloaded for inspection, or validated with a cryptographic signature or checksum. Consequently, the code that executes may differ from the content available at the time of this audit.

Use of HTTPS protects the connection in transit but does not mitigate compromise of the vendor domain, hosting infrastructure, DNS or certificate ecosystem, deployment pipeline, or installer itself. Because the response is piped directly into Bash, any supplied shell commands execute without an intermediate verification step.

The Skill describes itself as API-first and states that CLI integration is optional. Therefore, executing a remote installer is not necessary for the core REST-based functionality and exceeds the minimum execution privileges required by the declared purpose.

Attack Path

  1. A user or Agent follows the CLI installation instructions in SKILL.md.
  2. The shell retrieves the current response from https://vapi.ai/install.sh.
  3. The external response is passed directly to Bash without version pinning, inspection, signature verification, or checksum validation.
  4. If the remote source or its delivery chain is compromised, attacker-controlled shell commands execute with the permissions of the invoking user.
  5. Those commands can access data and modify resources available to that account, potentially including API credentials present in environment variables.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The resulting scope may include reading or modifying user-accessible files, ...[truncated 481 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash installation pattern.
  2. Prefer the documented REST workflow, which does not require installing the optional CLI.
  3. If the CLI is required, use a pinned, versioned release from an authenticated official release channel.
  4. Download the artifact separately rather than piping it into a shell:
    bash
    curl --fail --show-error --location \
  --output vapi-install.sh \
  "https://trusted.example/path/to/pinned/vapi-install.sh"
  5. Verify the downloaded artifact using a vendor-published cryptographic signature or an independently delivered SHA-256 checksum.
  6. Inspect the verified script before execution and run it as an unprivileged user.
  7. Avoid requesting sudo or other elevated privileges unless a specific installation step demonstrably requires them.
  8. Document the exact expected files, permissions, and network operations performed by the installer.
  9. Add a fixed version and integrity-verification procedure to ensure that the installed code matches the version reviewed during security assessment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
# create assistant
VAPI_API_KEY=... node skills/vapi/bin/vapi-api.mjs assistants:create \
  --name "Claw Con Concierge" \
  --modelProvider openai --model gpt-4o-mini \
  --voiceProvider 11labs --voiceId rachel

# start an outbound call (example shape; see swagger for required fields)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping a remotely fetched script directly into bash executes unverified code from the network with the user's privileges, creating a supply-chain and remote code execution risk. In an agent skill context, this is more dangerous because it may normalize unsafe automation patterns that operators or downstream agents could copy without verification.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Install:

bash
curl -sSL https://vapi.ai/install.sh | bash
vapi login

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipe into bash is a classic command-chaining pattern that removes any review boundary between retrieval and execution, enabling arbitrary command execution if the remote content or delivery path is compromised. Because this appears in setup instructions, it may be reused verbatim by users or automation, amplifying the blast radius of a compromise.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Install:

bash
curl -sSL https://vapi.ai/install.sh | bash
vapi login

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
API reference:

- https://api.vapi.ai/api (Swagger)

## Tooling options

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
API reference:

- https://api.vapi.ai/api (Swagger)

## Tooling options

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
## Files in this skill

- `skills/vapi/SKILL.md` — this file
- `skills/vapi/bin/vapi-api.mjs` — minimal REST helper

## Sources

Static analysis

No suspicious patterns detected.