Openclaw Voice Gpt Realtime

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:54 PM UTC
• Version: 0.1.4

Overview

This skill is a real AI phone-calling integration, but it exposes sensitive call context in normal logs and has an unauthenticated detailed status endpoint users should review before installing.

Install only if you are comfortable with an agent placing real phone calls through your Twilio account and sending call audio to OpenAI. Before use, restrict the public tunnel to only required webhook paths, avoid exposing /voice/status, keep inbound calls disabled or allowlisted, and assume task prompts may appear in process logs until the logging is fixed. Do not enable debug recording unless everyone involved has appropriate consent and you have a plan to delete the saved audio/transcripts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/server.ts:173

Finding

Unauthenticated Public Status Endpoint Performs Credentialed Provider Checks and Discloses Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/realtime-bridge.ts:139

Finding

Sensitive Call Prompts Are Logged Unconditionally Outside Debug Mode

Content

View full analysis

200 ? "..." : ""}`); } if (this.callContext.agentName) { console.log(`\x1b[35m[prompt]\x1b[0m \x1b[2m${this.callId}\x1b[0m agentName=${this.callContext.agentName}`); } console.log(`\x1b[35m[prompt]\x1b[0m \x1b[2m${this.callId}\x1b[0m final instructions (${systemPrompt.length} chars):\n${systemPrompt}`); ``` ### Technical Analysis `configureSession()` writes the task, agent name, part of the original custom system prompt, and the complete final system prompt to standard output for every call. These statements are not conditional on `config.debug`. The Skill explicitly expects call prompts to contain information required to complete real-world tasks, which can include: - Names and telephone numbers - Appointment dates and times - Reservation details - Preferences and budgets - Business or personal objectives - Other context needed by the voice agent Consequently, sensitive information is copied into process logs during normal operation even when recording and verbose debug logging are disabled. In deployments that collect stdout through service managers, containers, cloud logging agents, or centralized observability platforms, this data may be retained and made accessible to a broader grou ...[truncated 1586 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description emphasizes phone calling, but the documented notes also indicate debug mode can enable call recording, transcripts, and verbose logging that may persist sensitive data locally. If storage and retention behavior are not clearly disclosed up front, users may unknowingly capture personal or regulated information from third-party calls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill description emphasizes phone calling, but the documented notes also indicate debug mode can enable call recording, transcripts, and verbose logging that may persist sensitive data locally. If storage and retention behavior are not clearly disclosed up front, users may unknowingly capture personal or regulated information from third-party calls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description emphasizes phone calling, but the documented notes also indicate debug mode can enable call recording, transcripts, and verbose logging that may persist sensitive data locally. If storage and retention behavior are not clearly disclosed up front, users may unknowingly capture personal or regulated information from third-party calls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description emphasizes phone calling, but the documented notes also indicate debug mode can enable call recording, transcripts, and verbose logging that may persist sensitive data locally. If storage and retention behavior are not clearly disclosed up front, users may unknowingly capture personal or regulated information from third-party calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bridge forwards live caller audio to OpenAI and later stores transcripts, but this code provides no consent gate, disclosure, or policy enforcement before sending third-party voice data to an external processor. In a phone-call context, this is especially sensitive because callers may not expect AI processing or recording, and the deployment could violate privacy, wiretapping, or sector-specific compliance requirements depending on jurisdiction and use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file states that the skill persists transcripts and supports debug call recording, both of which can affect user privacy and data retention. Under the markdown-specific warning criteria, the description should disclose these potentially sensitive behaviors more explicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises transcript logging, call recording, and stored debug artifacts, but does not prominently warn users about privacy, consent, retention, and legal compliance implications. In a phone-calling skill, this is more sensitive than usual because recordings and transcripts may capture third-party conversations, personal data, and regulated information.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which executes code fetched at install time without pinning a specific reviewed version. If the upstream package or publishing account were compromised, users could execute unexpected code during installation, and this is especially relevant because the skill handles telephony and API credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation declares capabilities that require network access and use of sensitive credentials, but it does not define an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries increases the chance of overbroad execution and makes it harder for users or policy layers to understand and constrain what the skill can do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is capable of autonomously placing real outbound calls to third parties, but the description does not present that risk as an upfront warning at the top of the skill. In practice, users may trigger real-world actions with financial, privacy, consent, and reputational consequences without appreciating that the agent will contact external people directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill can initiate real outbound phone calls from tool/gateway execution without an explicit just-in-time confirmation or warning at the execution point. Because this action incurs real-world effects and possible financial/privacy consequences, an agent or user could trigger calls unintentionally or with insufficient awareness, especially through CLI or gateway paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest enables real phone calls and describes a realtime voice bridge using Twilio and OpenAI, but it does not explicitly warn that call audio, transcripts, and potentially sensitive conversational content will be transmitted to third-party providers. In a telephony skill, that omission can mislead users about privacy boundaries and consent requirements, increasing the risk of exposing personal, business, or regulated information during calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code persistently stores call metadata, task content, outcomes, and error details to a local JSONL file in the user's home directory. In the context of a voice-calling skill, these fields can contain sensitive personal data, phone numbers, operational instructions, and potentially confidential call context, creating a privacy and data-retention risk if the host is multi-user, compromised, backed up, or inspected later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This debug component persists highly sensitive phone-call data to disk, including inbound/outbound audio and full transcripts with event metadata. In the context of a voice-calling skill, these files can capture personal data, credentials, financial details, and other regulated information; if debug mode is enabled without strong consent, retention controls, and access restrictions, it creates a significant privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code logs full system instructions and call-context data, including potentially sensitive task details and custom system prompts, directly to console and optionally logs the full session payload. These logs can expose secrets, PII, internal business logic, or operational instructions to anyone with log access, and phone/agent workflows commonly contain sensitive customer data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The end_call handler performs an irreversible operation by terminating the call through Twilio after a short delay. There is no user confirmation, approval gate, or explicit warning in this file indicating that the model may end calls autonomously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code can accept inbound calls and immediately route them into an AI-driven conversation when inbound calling is enabled and policy is set to open, with no user-facing warning, consent prompt, or stronger caller verification. In the context of a voice agent that can interact naturally and potentially act on behalf of an OpenClaw agent, arbitrary external callers could reach the agent, extract information, trigger actions, or abuse resources simply by dialing the number.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/status.ts (reported line 91)May include surrounding context.

ts

async function checkOpenAI(config: PluginConfig): Promise<StatusCheck> {
  try {
    // Test OpenAI API key with a simple models list request
    const res = await fetch("https://api.openai.com/v1/models", {
      headers: { Authorization: `Bearer ${config.openai.apiKey}` },
    });

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The initiateCall method sends the destination phone number, callback URLs, call identifiers, and call-status events to Twilio via a network API call. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment warning that user or system data will be transmitted to an external telephony provider.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The tool description says it can make outbound business calls on behalf of the user for reservations, appointments, inquiries, etc., but it does not define narrow trigger conditions, approval requirements, or exclusions. For a tool that can initiate external real-world actions and disclose user information over the phone, broad invocation scope raises the chance of unintended calls, overbroad automation, or use in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json

},
  "dependencies": {
    "@sinclair/typebox": "0.34.48",
    "twilio": "^5.4.0",
    "ws": "^8.18.0",
    "zod": "^3.24.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 38)May include surrounding context.

json

"dependencies": {
    "@sinclair/typebox": "0.34.48",
    "twilio": "^5.4.0",
    "ws": "^8.18.0",
    "zod": "^3.24.0"
  },
  "devDependencies": {

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

The skill depends on ws for realtime voice communication, so an unverifiable WebSocket version is more significant here than in a non-networked package. Because the manifest allows a range rather than an exact patched version, consumers may resolve a ws release affected by denial-of-service or memory disclosure issues, which is dangerous for an internet-facing call-handling component.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 39)May include surrounding context.

json

"@sinclair/typebox": "0.34.48",
    "twilio": "^5.4.0",
    "ws": "^8.18.0",
    "zod": "^3.24.0"
  },
  "devDependencies": {
    "@types/bun": "latest",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.