ClawdTalk

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:34 AM UTC
• Version: 2.0.5

Overview

This skill is a real phone and SMS bridge, but it gives the remote service broad access to the user's main agent session and has approval behavior that can fail open.

Install only if you trust clawdtalk.com/Telnyx with voice transcripts, SMS content, mission data, and the ability to send requests into your main agent session. Review the sessions_send gateway allowlist change, protect skill-config.json because it may contain live API and gateway tokens, avoid using this with untrusted callers or SMS senders, and consider isolating it to a lower-privilege agent/session until approvals fail closed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents access to environment variables, local files, shell commands, and multiple network endpoints, yet it does not declare permissions explicitly. This weakens user review and consent because installers cannot easily see the effective trust boundary before enabling a skill that can read configuration, modify files, and send conversation data off-box.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior materially exceeds the stated description: besides voice/SMS/mission support, it modifies gateway configuration, bridges calls into the local agent session, auto-processes inbound communications, supports approval workflows for unrelated actions, and can self-update from GitHub. This mismatch can cause users to grant trust for a communications skill without realizing it also has local configuration, persistence, and remote-update capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The approval workflow is framed as usable for destructive or account actions such as deleting repos, sending money, and posting to social media, which goes beyond the stated telephony/messaging mission of the skill. Expanding into high-risk account actions increases the blast radius if the voice channel, approval channel, or agent logic is abused or misunderstood.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script's header claims no environment-variable usage, but the implementation reads multiple local .env files and substitutes their values into configuration. This hidden credential sourcing expands the trust boundary and can surprise users into exposing API keys from unrelated local config stores.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The inline documentation understates file access by saying only skill-config.json is read, while the code also scans and parses multiple .env files. This discrepancy impairs informed consent and security review, making credential access less visible to operators.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The assistant creation path explicitly allows webhook tools with arbitrary URLs, enabling an agent created through this client to trigger outbound HTTP requests to user-specified destinations. In the context of a voice/SMS mission skill, this meaningfully expands capability and can be abused for data exfiltration, interaction with internal services, or unexpected side effects if tool definitions are not tightly controlled.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The client implements additional capabilities beyond the stated skill description, including walkie-talkie request handling and approval workflow integration. Undisclosed capabilities materially change the trust boundary of the skill and can cause users or operators to authorize a component with broader communication and control surfaces than expected.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The approval subsystem can create approval requests, maintain pending approval state, receive approval decisions over WebSocket, and poll approval APIs, but this behavior is not disclosed in the skill description. That omission is security-relevant because the skill is not merely relaying calls/SMS; it can trigger user-facing authorization flows and interact with sensitive decision endpoints.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The embedded voice-call system prompt tells the downstream agent it has 'FULL tool access' to Slack, memory, web search, and more, greatly expanding the effective privileges of a voice/SMS client. In this context, untrusted callers or message senders may be able to steer the agent into accessing unrelated systems or sensitive data through natural-language requests.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script may execute a shell command at runtime to install dependencies into the skill directory. Runtime package installation increases supply-chain and integrity risk, modifies the local environment unexpectedly, and exceeds the reasonable scope of a communications client.

Intent-Code Divergence

High

• Confidence: 93% confidence
• Finding: The header claims the script writes nothing, but the code can run npm install and modify files under the skill directory. Misrepresenting write behavior is dangerous because operators may grant execution based on inaccurate assumptions about filesystem effects and change control.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script explicitly prompts the user to allow the gateway HTTP API to invoke sessions_send, which routes arbitrary spoken requests into the main agent session with its full context and tool access. Even though this is described as required for functionality, it weakens a default security boundary and expands remote invocation capability from the voice integration to whatever tools the main agent can access.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The header comments say the script configures connection details and tools policy, but they under-emphasize that it reads gateway auth tokens from local config and writes them into skill-config.json while also modifying gateway policy to permit sessions_send. This creates a transparency and consent problem: operators may run the script without realizing it handles secrets and changes a security-sensitive allowlist.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README explicitly documents outbound calling and SMS features, including commands that can contact arbitrary phone numbers, but it does not prominently warn users about real-world external effects such as contacting third parties, telecom charges, consent requirements, or accidental misuse. In a voice/SMS skill, that omission matters because users may treat the examples as low-risk local actions when they actually trigger real communications outside the system.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs the agent to request, validate, and persist a live API key, but it does not warn that the key is sensitive, should be redacted from logs, or should be handled via secure secret storage. In this skill context, the risk is elevated because the agent is explicitly told to pass the key via environment variable and save it into `skill-config.json`, which can expose the credential through shell history, process listings, logs, or accidental file disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Mission memory is persisted to .missions_state.json without encryption, minimization, retention controls, or any user warning, and the API is designed to store arbitrary values that may include phone numbers, mission data, conversation results, or other sensitive information. In a telephony/messaging skill, local persistence of such data raises privacy and secret-handling risks, especially on shared systems or where file permissions are weak.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: When approval devices are unavailable, the code explicitly skips approval and proceeds to route sensitive requests to the main agent. This defeats the stated safety control for destructive or user-impersonating actions and creates a direct path for unauthorized execution of sensitive operations.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script installs dependencies by spawning a shell command without any user-facing warning or confirmation. Even though the command is static, it still introduces unreviewed execution and environmental modification during normal operation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script reads gateway.auth.token from the user's main gateway configuration and writes it into skill-config.json without a prominent warning at the point of write or any permission hardening. Duplicating a sensitive bearer token into another file increases exposure through accidental disclosure, weaker file permissions, backups, logs, or later exfiltration by other local processes or skills.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The voice prompt encourages the agent to use broad tools and to narrate progress from sources like Slack, memory, and web search during a live phone call, while explicitly saying reads/searches do not need approval. In a voice-call context, that increases the risk of exposing sensitive information aloud to whoever is on the call, including spoofed or unauthorized callers.

Ssd 3

Medium

• Confidence: 86% confidence
• Finding: Inbound SMS content is forwarded into the persistent main session, creating a durable natural-language path for retaining sender-provided data and influencing future agent behavior. This is risky because SMS senders may be untrusted, and their content can become part of a long-lived context shared with other interactions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## 1.2.0
- **SMS Reply Support**: Incoming SMS messages now route to your main agent session
- Agent generates response and automatically sends reply via ClawdTalk
- SMS replies truncated to fit SMS limits

## 1.1.0

• Confidence: 90% confidence
• Finding: automatically send

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

return;
        } else if (approvalDecision === 'no_devices' || approvalDecision === 'no_devices_reached') {
          this.log('INFO', 'No devices for approval, skipping approval and routing directly');
          // No devices — skip approval entirely and route to agent
        } else if (approvalDecision === 'timeout') {
          this.sendDeepToolResult(requestId, 'The approval request timed out. Would you like to try again?');
          this.log('INFO', 'Approval timed out');

• Confidence: 99% confidence
• Finding: skip approval

Credential Access

High

• Category: Privilege Escalation

Content

local config
  config=$(cat "$CONFIG_FILE")
  
  # Find .env files
  local env_files=(
    "$HOME/.openclaw/.env"
    "$HOME/.clawdbot/.env"

• Confidence: 83% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

# Find .env files
  local env_files=(
    "$HOME/.openclaw/.env"
    "$HOME/.clawdbot/.env"
    "$SKILL_DIR/.env"
  )

• Confidence: 83% confidence
• Finding: .env"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.credential_exposure_instructions, suspicious.dangerous_exec, suspicious.env_credential_access (+1 more)

Instructions expose credentials through shell, git config, or agent memory.

Critical

• Code: suspicious.credential_exposure_instructions
• Location: SKILL.md:71

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/ws-client.js:1043

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/ws-client.js:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/ws-client.js:162