ClawHub
Back to skill

Security audit

botcall

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly about using Botcall phone numbers, but it gives agents broad phone-verification and billing-changing capabilities without enough scoping or user-control guidance.

Review this skill before installing. Only use it for phone numbers, SMS codes, and account workflows you own or are authorized to manage. Do not let an agent run signup, 2FA, upgrade, or billing commands automatically; require explicit confirmation, pin and review npm package versions where possible, and use a minimally scoped Botcall API key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding
Unpinned Third-Party npm Packages Execute with Access to a Sensitive API Key## Vulnerability Details **File Location**: `SKILL.md`, lines 12–17 and 99–110 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: botcall-cli kind: node package: botcall bins: [botcall] label: Install botcall CLI (npm) ``` ```json { "mcpServers": { "botcall": { "command": "npx", "args": ["@botcallio/mcp"], "env": { "BOTCALL_API_KEY": "bs_live_YOUR_KEY" } } } } ``` ### Technical Analysis The Skill instructs users to install `botcall` and execute `@botcallio/mcp` without specifying exact package versions or integrity constraints. In particular, `npx @botcallio/mcp` can retrieve and execute the package version currently selected by the npm registry when the MCP server starts. Because the MCP process is explicitly supplied with `BOTCALL_API_KEY`, code contained in the resolved package can access that credential. The project includes no lockfile, integrity hash, vendored source, or other mechanism establishing the precise package contents that will execute. There is no evidence in the audited file that either named package is currently malicious. The vulnerability is the mutable and unaudited dependency execution path, which creates supply-chain exposure if a package, maintainer account, publication pipeline, or registry resolution process is compromised. ### Attack Path 1. An attacker compromises the npm package, a package maintainer account, or its release pipeline. 2. The attacker publishes a malicious version that is selected by the unpinned `botcall` or `@botcallio/mcp` package reference. 3. A user installs the CLI or starts the configured MCP server. 4. npm or `npx` downloads and executes the attacker-controlled release. 5. The malicious MCP package reads `BOTCALL_API_KEY` from its environment. 6. The package can exfiltrate or misuse the key and execute commands with the permissions of the user running the Ag ...[truncated 738 chars]
Remediation
## Remediation Suggestions 1. Pin both npm dependencies to exact, reviewed versions rather than relying on mutable registry resolution: - Use an exact version for `botcall`. - Replace `npx @botcallio/mcp` with an exact version or, preferably, a locally installed and locked executable. 2. Maintain a lockfile containing package versions and integrity hashes, and enforce immutable or reproducible installation in deployment workflows. 3. Review package provenance, publisher identity, release history, and dependency tree before approving upgrades. 4. Use npm provenance and integrity verification where available, and consider an internal package mirror or allowlist for approved artifacts. 5. Run the CLI and MCP server under a restricted operating-system account or sandbox with minimal filesystem and network permissions. 6. Scope `BOTCALL_API_KEY` to the minimum necessary permissions and avoid exposing unrelated secrets to the process. 7. Rotate the API key if there is any indication that an untrusted package version has already executed. 8. Establish a controlled dependency-update process that reviews and tests each new version before deployment.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description is broadly phrased to trigger on common workflows like signups, SMS receipt, and phone verification, which can cause the agent to invoke it in many unrelated or sensitive contexts. In this specific skill, the danger is elevated because it enables provisioning phone numbers and handling verification codes, which can facilitate account creation, automated onboarding, and bypass of friction controls on third-party services.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The documentation includes billing-affecting actions like plan upgrades and opening the billing portal without warning that these operations may incur charges or permanently change the account state. This is risky because an autonomous or semi-autonomous agent may execute these commands during routine task completion, leading to unexpected financial impact and unauthorized account modifications.

Static analysis

No suspicious patterns detected.