botcall

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:24 AM UTC
• Version: 1.0.0

Overview

The skill is clearly about using Botcall phone numbers, but it gives agents broad phone-verification and billing-changing capabilities without enough scoping or user-control guidance.

Review this skill before installing. Only use it for phone numbers, SMS codes, and account workflows you own or are authorized to manage. Do not let an agent run signup, 2FA, upgrade, or billing commands automatically; require explicit confirmation, pin and review npm package versions where possible, and use a minimally scoped Botcall API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party npm Packages Execute with Access to a Sensitive API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–17 and 99–110
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: botcall-cli
    kind: node
    package: botcall
    bins: [botcall]
    label: Install botcall CLI (npm)

json

{
  "mcpServers": {
    "botcall": {
      "command": "npx",
      "args": ["@botcallio/mcp"],
      "env": {
        "BOTCALL_API_KEY": "bs_live_YOUR_KEY"
      }
    }
  }
}

Technical Analysis

The Skill instructs users to install botcall and execute @botcallio/mcp without specifying exact package versions or integrity constraints. In particular, npx @botcallio/mcp can retrieve and execute the package version currently selected by the npm registry when the MCP server starts.

Because the MCP process is explicitly supplied with BOTCALL_API_KEY, code contained in the resolved package can access that credential. The project includes no lockfile, integrity hash, vendored source, or other mechanism establishing the precise package contents that will execute.

There is no evidence in the audited file that either named package is currently malicious. The vulnerability is the mutable and unaudited dependency execution path, which creates supply-chain exposure if a package, maintainer account, publication pipeline, or registry resolution process is compromised.

Attack Path

1. An attacker compromises the npm package, a package maintainer account, or its release pipeline.
2. The attacker publishes a malicious version that is selected by the unpinned botcall or @botcallio/mcp package reference.
3. A user installs the CLI or starts the configured MCP server.
4. npm or npx downloads and executes the attacker-controlled release.
5. The malicious MCP package reads BOTCALL_API_KEY from its environment.
6. The package can exfiltrate or misuse the key and execute commands with the permissions of the user running the Ag ...[truncated 738 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both npm dependencies to exact, reviewed versions rather than relying on mutable registry resolution:
   • Use an exact version for botcall.
   • Replace npx @botcallio/mcp with an exact version or, preferably, a locally installed and locked executable.
2. Maintain a lockfile containing package versions and integrity hashes, and enforce immutable or reproducible installation in deployment workflows.
3. Review package provenance, publisher identity, release history, and dependency tree before approving upgrades.
4. Use npm provenance and integrity verification where available, and consider an internal package mirror or allowlist for approved artifacts.
5. Run the CLI and MCP server under a restricted operating-system account or sandbox with minimal filesystem and network permissions.
6. Scope BOTCALL_API_KEY to the minimum necessary permissions and avoid exposing unrelated secrets to the process.
7. Rotate the API key if there is any indication that an untrusted package version has already executed.
8. Establish a controlled dependency-update process that reviews and tests each new version before deployment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broadly phrased to trigger on common workflows like signups, SMS receipt, and phone verification, which can cause the agent to invoke it in many unrelated or sensitive contexts. In this specific skill, the danger is elevated because it enables provisioning phone numbers and handling verification codes, which can facilitate account creation, automated onboarding, and bypass of friction controls on third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation includes billing-affecting actions like plan upgrades and opening the billing portal without warning that these operations may incur charges or permanently change the account state. This is risky because an autonomous or semi-autonomous agent may execute these commands during routine task completion, leading to unexpected financial impact and unauthorized account modifications.

Content

No source excerpt is available for this finding.