Slybroadcast Voicemail

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 PM UTC
• Version: 1.0.0

Overview

This skill is coherent and not malicious, but it enables mass voicemail campaigns and public audio staging without enough privacy, consent, or access-control guidance.

Review this carefully before installing. Use it only for campaigns where you have lawful authority and recipient consent, keep phone numbers and message content minimal, store API credentials in protected environment variables or a secrets manager, and make any staged audio URLs private, unguessable, short-lived, and promptly deleted after use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18

Finding

Publicly Reachable Staged Voicemail Audio Lacks Documented Access Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-21 and SKILL.md:99-100
Vulnerability Type: Public exposure of sensitive staged audio
Risk Level: Medium

Vulnerable Code Snippet

markdown

For local-file or AI-generated audio, also set:

- `SLYBROADCAST_PUBLIC_AUDIO_BASE_URL`
- `SLYBROADCAST_AUDIO_STAGING_DIR`

Supporting behavior:

markdown

- Local and AI-generated files are staged first and must be publicly reachable for Slybroadcast to fetch.

Technical Analysis

The documented workflow requires local or AI-generated voicemail recordings to be placed in a publicly reachable staging location so that Slybroadcast can retrieve them. The skill documentation does not specify access controls, short-lived signed URLs, cryptographically unpredictable filenames, directory-listing restrictions, retention limits, or automatic deletion after retrieval.

Voicemail recordings may include personal, commercial, medical, appointment, or other confidential information. If staging URLs are predictable, disclosed through logs, retained in command histories, leaked by downstream services, or exposed through directory indexing, an unauthorized party could retrieve the audio.

The available project contains only documentation, so no implementation was available to determine whether safeguards exist outside the audited artifact. The finding therefore applies specifically to the insecure workflow and missing security requirements documented in this skill.

Attack Path

1. A user supplies a local recording or requests AI generation of a voicemail containing sensitive information.
2. The workflow writes the audio into SLYBROADCAST_AUDIO_STAGING_DIR.
3. The file is exposed through SLYBROADCAST_PUBLIC_AUDIO_BASE_URL so Slybroadcast can fetch it.
4. The staging URL or filename becomes available through predictable naming, directory listing, application logs, command history, shared telemetry, or downstream leakage.
5. An unauthorized part ...[truncated 761 chars]

Remediation

View remediation

Remediation Suggestions

1. Use short-lived, single-purpose signed URLs rather than permanently public file URLs.
2. Generate cryptographically random object names with sufficient entropy; never derive filenames from recipient numbers, campaign names, or message text.
3. Disable directory listing and unauthenticated object enumeration on the staging service.
4. Automatically delete staged audio immediately after confirmed retrieval or after a short expiration period.
5. Apply a strict maximum retention period as a fallback for failed or abandoned campaigns.
6. Prevent staging URLs and sensitive filenames from appearing in application logs, shell history, analytics, or error telemetry.
7. Restrict accepted file types, validate media content, and serve files with explicit safe content types.
8. Encrypt recordings at rest and use HTTPS for all retrieval operations.
9. Document that public staging may expose sensitive material and obtain explicit user confirmation before publishing an audio file.
10. Add implementation-level tests verifying URL expiration, non-enumerability, deletion, disabled directory indexing, and absence of sensitive URL logging.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill facilitates mass ringless voicemail campaigns and explicitly supports staging local or AI-generated audio at a publicly reachable URL, but it provides no warning that phone numbers, message content, and audio will be transmitted to third-party services and may become publicly exposed during staging. In this context, omission of privacy, consent, and outreach-risk guidance increases the chance of misuse, accidental data disclosure, and non-compliant messaging campaigns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The prerequisites instruct users to supply multiple sensitive credentials, including Slybroadcast and ElevenLabs API secrets, without any guidance on secure storage, least-privilege handling, or avoiding accidental disclosure in logs and prompts. While this is common setup material, the absence of secret-handling warnings in an LLM-oriented skill raises the risk that users will paste credentials into unsafe contexts or expose them through misconfiguration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.