botcall-mcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:04 AM UTC
• Version: 0.1.1

Overview

The skill is coherent, but it gives an agent real phone-number and SMS-code handling powers while installing an unpinned third-party MCP package.

Review this carefully before installing. Use it only for accounts and services you are authorized to verify, expect SMS contents and verification codes to be sensitive, watch for Botcall plan charges, avoid storing broad or long-lived API keys in config files, and prefer a pinned or otherwise vetted package version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

claude mcp add botcall -- npx -y botcall-mcp

Technical Analysis

The installation instruction uses npx -y to download and execute botcall-mcp without specifying an exact version, lockfile, checksum, or other integrity constraint. The -y option also suppresses the normal installation confirmation.

Consequently, the code executed by users is whatever package version the npm registry resolves at installation time. Its effective behavior can change after this Skill has been reviewed. The project contains only SKILL.md; the dependency's implementation is not included and therefore could not be audited as part of this artifact.

This is a supply-chain trust issue rather than evidence that the current npm package is malicious. Exploitation would require compromise or malicious control of the package, its maintainer account, or the relevant package-distribution path.

Attack Path

1. An attacker compromises the botcall-mcp npm package, its publisher account, or its release process.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the documented setup command.
4. npx -y resolves, downloads, and executes the attacker-controlled release without an interactive confirmation or exact-version constraint.
5. The malicious package executes with the privileges of the user running Claude or the command.
6. When configured as documented, the process can access BOTCALL_API_KEY and could transmit it or other data available within the process's permissions.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's account. The resulting access may include the configured Botcall API key, files readable by that user, environment variables in ...[truncated 245 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin botcall-mcp to a specific, reviewed version rather than allowing npm to resolve the latest release.
2. Maintain a lockfile with npm integrity metadata and deploy from a controlled installation workflow.
3. Verify the package's provenance, signatures, publisher identity, and integrity before execution.
4. Avoid npx -y for security-sensitive installation instructions so users can review the resolved package and version before it runs.
5. Include or vendor the reviewed MCP server source in the auditable project where practical.
6. Run the server in a sandbox with minimal filesystem, environment, and network access.
7. Expose only the required API credential to the process, use a narrowly scoped key where supported, and establish key rotation and revocation procedures.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages agents to provision real phone numbers, receive SMS, and extract verification codes, but it does not warn users about privacy, legal, financial, and account-security implications. Because the tool is explicitly designed to handle authentication messages and verification codes, missing safety guidance makes misuse and accidental account compromise more likely in this context than in a generic messaging skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to install and run an MCP server directly via npx -y botcall-mcp without pinning a specific version. This creates a supply-chain risk: a newly published or compromised package version could execute arbitrary code in the user's environment, and this skill also expects a live API key, increasing the sensitivity of that execution context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.