Security audit

Phone Voice Integration

Security checks across malware telemetry and agentic risk

Overview

This voice-call skill appears purpose-related, but it exposes a powerful phone and LLM bridge with unclear boundaries, public-tunnel risk, memory use, and sensitive call logging concerns.

Install only if you are prepared to operate it like a public phone-service backend: use strong random bearer tokens, restrict endpoints where possible, monitor usage and call costs, disable outbound calling if unnecessary, review what call content is logged or remembered, and get appropriate caller consent before recording or storing transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest says the skill connects ElevenLabs Agents to OpenClaw, but the document later states the bridge bypasses OpenClaw and talks directly to Claude. This is a security-relevant integrity issue because users may rely on OpenClaw’s expected controls, tool mediation, or policy boundaries when in fact requests are handled by an alternate direct path.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The architecture diagram claims requests flow through OpenClaw tools, but the setup section says OpenClaw is bypassed entirely. That discrepancy can cause operators to deploy the skill under false assumptions about enforcement points, auditing, and tool access, increasing the chance of insecure exposure or misconfigured trust boundaries.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The flow description implies OpenClaw-mediated behavior while the setup explicitly says the bridge directly calls Anthropic and injects memory itself. This inconsistency hides the true security boundary and may lead users to overtrust the integration, especially around prompt handling, tool invocation, and data governance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises transcript logging, summaries, caller ID handling, and cross-call memory without warning that sensitive call content and metadata will be stored. In a phone-based assistant context, this can expose highly sensitive personal data and create privacy, retention, and consent risks for both the operator and callers.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to expose a local bridge via Cloudflare Tunnel or ngrok but does not emphasize that this creates an internet-reachable endpoint connected to telephony, LLM access, memory injection, and potentially outbound calling. In this context, weak authentication or misconfiguration could enable unauthorized use, data exfiltration, prompt abuse, or billing abuse.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.