ClawHub
Back to skill

Security audit

Phone Voice Integration

Security checks for vulnerabilities and agentic risk

Overview

This phone assistant guide is coherent in broad purpose, but it needs Review because it exposes broad personal memory, call history, and optional calendar data through a public voice bridge without clear caller-level controls or retention limits.

Review the actual bridge implementation before installing. Use this only if you are comfortable sending call content and selected local context to external voice and LLM providers, and first add strong authentication, caller-specific data scopes, minimal memory retrieval, transcript retention limits, log protection, and clear handling for secrets and spoken PINs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:50
Finding

Overprivileged Automatic Injection of Sensitive Memory and Call Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The documented voice PIN example uses a static shared secret intended to be spoken aloud over a phone call, which is weak authentication and highly exposed to interception, replay, shoulder surfing, transcript retention, and social engineering. In this skill's context, the PIN is specifically used for unknown callers or high-security actions, making compromise more damaging because it could gate access to sensitive memory or privileged actions.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

Voice PIN Challenge

For unknown callers or high-security actions:

python
VOICE_PIN = "banana"  # Set in .env

Caller must say the PIN to proceed.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation materially misrepresents the trust boundary: it says the skill connects ElevenLabs to OpenClaw, but the implementation instead bypasses OpenClaw and sends conversations to Anthropic directly. That discrepancy can cause operators to expose memory, caller data, and tool-related context to a different external processor than expected, undermining informed consent and safe deployment decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions explicitly say OpenClaw chat completions are not needed because the bridge bypasses OpenClaw, contradicting the skill's purpose and concealing the actual architecture. This increases the chance an admin deploys the integration with incorrect assumptions about policy enforcement, logging, and tool controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash
# Step 1: Store your bridge auth token as a secret
curl -X POST https://api.elevenlabs.io/v1/convai/secrets \
  -H "xi-api-key: YOUR_ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash
# Step 1: Store your bridge auth token as a secret
curl -X POST https://api.elevenlabs.io/v1/convai/secrets \
  -H "xi-api-key: YOUR_ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash
# Step 1: Store your bridge auth token as a secret
curl -X POST https://api.elevenlabs.io/v1/convai/secrets \
  -H "xi-api-key: YOUR_ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that MEMORY.md, USER.md, recent transcripts, and optional live data are injected into prompts sent to Claude, but it does not provide a clear user-facing privacy warning or consent model. This can disclose sensitive personal data, historical conversations, calendar details, or weather/location context to external services and to any caller who can elicit model responses from that context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation describes transcript and cost logging, including caller numbers, timestamps, duration, and conversation-derived summaries, without clearly warning that this data is retained on disk. Retained call metadata and transcripts create privacy and breach risk, especially for voice interactions that may contain sensitive personal or authentication information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The sample configuration sets the agent language to "en", which imposes a specific language by default. The file does not indicate that users can choose another language or that English is required for a justified regional/compliance reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.