ClawHub
Back to skill

Security audit

Vapi AI

Security checks for vulnerabilities and agentic risk

Overview

This Vapi skill is mostly coherent, but it includes an unsafe remote CLI installer and a helper that can send the Vapi API key to a user-controlled base URL.

Review before installing. Use the REST helper rather than the curl-to-bash CLI installer unless you independently verify the installer source. Keep VAPI_API_KEY narrowly scoped where possible, do not set VAPI_BASE_URL except in a controlled test environment, and require explicit approval before creating outbound calls or changing phone number or webhook routing.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:85
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 85
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash
curl -sSL https://vapi.ai/install.sh | bash

Technical Analysis

The installation instructions download a mutable script from an external URL and immediately execute the response with Bash. There is no version pinning, signature verification, checksum validation, or opportunity to inspect the downloaded content before execution.

HTTPS provides transport protection but does not establish that every future response is safe or immutable. If the vendor host, DNS configuration, CDN, deployment pipeline, or installer distribution infrastructure is compromised, the command will execute attacker-controlled shell code with the privileges and environment of the invoking user.

The CLI integration is optional, while the project already provides a REST helper. Consequently, remote shell execution is not necessary for the Skill's primary declared functionality and exceeds the minimum capabilities required.

Attack Path

  1. An attacker compromises or otherwise gains control over the response served from https://vapi.ai/install.sh.
  2. The attacker modifies the installer response to contain arbitrary shell commands.
  3. A user or Agent follows the documented installation command.
  4. curl retrieves the attacker-controlled response and streams it directly to Bash.
  5. Bash executes the payload without integrity verification or prior review.
  6. The payload operates with the invoking user's permissions and can access files, environment variables, credentials, and available network resources.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. Depending on that account's privileges and environment, an attacker could:

  • Read or modify files accessible to the user.
  • St ...[truncated 329 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Prefer a pinned, versioned release obtained from a verified official package repository.
  • If a standalone installer is required, download it to a local file without executing it immediately.
  • Publish and verify a cryptographic signature using a trusted, separately distributed signing key.
  • Publish a version-specific checksum and compare it before execution.
  • Allow users to inspect the downloaded script before explicitly invoking it.
  • Run installation with a non-administrative account and request elevated privileges only for narrowly scoped operations that require them.
  • Document the REST helper as the default approach because it does not require installation of a remote script.
  • Pin the installer or release URL to a reviewed version rather than using a mutable endpoint.

T09 · Insecure Skill Coding Practices

Warning
Location
bin/vapi-api.mjs:8
Finding

Configurable API Base URL Can Exfiltrate the Vapi Bearer Credential

Content
View full analysis

Vulnerability Details

File Location: bin/vapi-api.mjs, lines 8 and 29–33
Vulnerability Type: Unrestricted credential forwarding to a configurable origin
Risk Level: Medium

Vulnerable Code:

js
const BASE = process.env.VAPI_BASE_URL || "https://api.vapi.ai";
js
const res = await fetch(`${BASE}${path}`, {
  method,
  headers: {
    Authorization: `Bearer ${KEY}`,
    "Content-Type": "application/json",
  },

Technical Analysis

The helper allows the VAPI_BASE_URL environment variable to replace the official API origin. The value is not validated against an allowlist and is not required to use HTTPS. Every request then includes VAPI_API_KEY in its Authorization header.

An attacker who can influence the process environment can set the base URL to an attacker-controlled server. Running any supported command will then disclose the bearer credential to that server. This override is not documented in the Skill instructions, which declare https://api.vapi.ai as the API endpoint.

Although control of the environment is a prerequisite, arbitrary-origin credential forwarding unnecessarily broadens the helper's authority. The declared production integration only needs to communicate with the official Vapi API.

Attack Path

  1. An attacker, malicious wrapper, compromised launcher, or unsafe environment configuration sets VAPI_BASE_URL to an attacker-controlled URL.
  2. The user supplies a valid VAPI_API_KEY and runs any helper command, such as assistants:list.
  3. The helper constructs the request using the attacker-selected base URL.
  4. The request includes Authorization: Bearer followed by the valid Vapi API key.
  5. The attacker-controlled server records the authorization header.
  6. The attacker reuses the stolen key against the genuine Vapi API to perform operations permitted by that credential.

Impact Assessment

Exploitation can disclose the complete V ...[truncated 641 chars]

Remediation
View remediation

Remediation Suggestions

  • Hard-code https://api.vapi.ai when custom endpoints are not an explicit requirement.
  • If custom endpoints are required for development, enforce an allowlist of trusted HTTPS origins.
  • Reject non-HTTPS URLs before constructing a request.
  • Parse the base URL with the standard URL API and validate its protocol, hostname, port, username, and password fields.
  • Require an explicit development-only flag before permitting a non-production endpoint.
  • Do not attach the production bearer credential to untrusted origins.
  • Disable or strictly validate cross-origin redirects so the authorization header cannot reach another host.
  • Document any supported endpoint override and its security implications.
  • Use narrowly scoped API credentials where the Vapi platform supports them, and rotate any credential suspected of exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
# create assistant
VAPI_API_KEY=... node skills/vapi/bin/vapi-api.mjs assistants:create \
  --name "Claw Con Concierge" \
  --modelProvider openai --model gpt-4o-mini \
  --voiceProvider 11labs --voiceId rachel

# start an outbound call (example shape; see swagger for required fields)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to install the CLI via a remote shell pipeline, which executes code fetched over the network without prior integrity verification. If the install script or delivery path is compromised, this can lead to arbitrary code execution on the host running the skill setup.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Install:

bash
curl -sSL https://vapi.ai/install.sh | bash
vapi login

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping downloaded content directly into bash creates a dangerous execution chain with no opportunity for inspection, sandboxing, or integrity checks. In the context of an agent skill, this is especially risky because an automated system may reproduce the pattern non-interactively, amplifying supply-chain compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Install:

bash
curl -sSL https://vapi.ai/install.sh | bash
vapi login

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
## References

- Docs: https://docs.vapi.ai/quickstart/introduction
- API: https://api.vapi.ai/api
- CLI: https://github.com/VapiAI/cli
- Example server: https://github.com/VapiAI/example-server-javascript-node

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
## References

- Docs: https://docs.vapi.ai/quickstart/introduction
- API: https://api.vapi.ai/api
- CLI: https://github.com/VapiAI/cli
- Example server: https://github.com/VapiAI/example-server-javascript-node

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
## References

- Docs: https://docs.vapi.ai/quickstart/introduction
- API: https://api.vapi.ai/api
- CLI: https://github.com/VapiAI/cli
- Example server: https://github.com/VapiAI/example-server-javascript-node

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill explicitly enables creating and ending real phone calls but does not present a clear warning that these actions can incur costs, contact real users, or disrupt live operations. In an agentic context, this increases the chance of unsafe execution because the operator may not realize the real-world consequences of call-control actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Managing phone numbers and webhooks can alter production routing, notification flows, and downstream data delivery, yet the skill does not clearly warn about those operational consequences. In a live environment, an agent following these instructions could unintentionally break service routing or redirect sensitive event traffic.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
## Files in this skill

- `skills/vapi/SKILL.md` — this file
- `skills/vapi/bin/vapi-api.mjs` — minimal REST helper

## Sources

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script exposes a direct calls:create action that places outbound phone calls as soon as the command is invoked, without any built-in confirmation, dry-run mode, or user-warning step. In an agent-skill context, this is risky because a higher-level agent, prompt injection, or user misunderstanding could trigger real-world telephony actions and costs immediately, making the absence of friction a meaningful safety issue.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
bin/vapi-api.mjs:9