ClawHub
Back to skill

Security audit

AI Phone Calls (Bland AI)

Security checks for vulnerabilities and agentic risk

Overview

The skill can do its advertised Bland AI phone-call task, but it needs review because it sends phone numbers and call content to a third-party API despite a self-hosted privacy claim and can initiate real calls without a confirmation step.

Review this before installing if calls may include personal, business, medical, financial, or legally sensitive details. Treat phone numbers, task instructions, transcripts, summaries, and recordings as data sent to or returned from Bland AI, not as local-only or self-hosted data. Use explicit user confirmation before placing calls, be careful with recording consent, and avoid storing broad account API keys where other local tools can read them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:19
Finding

Misleading Self-Hosting and Data-Privacy Disclosure

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
check-call.sh:78
Finding

Untrusted Call Content Is Printed Without Terminal Control-Sequence Sanitization

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description emphasizes an action capability: making AI-powered phone calls on the user's behalf. The supplied script only performs a read operation against the Bland AI API for an existing call ID. It does not create, schedule, or place calls, nor does it implement booking or appointment-making behavior. While showing transcripts is loosely related to 'reports back with transcripts,' the main behavior here is inspection of existing call records, including transcript, summary, and recording URL retrieval. That is a materially different primary purpose from initiating AI phone calls, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bland.sh (reported line 23)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bland.sh (reported line 24)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check-call.sh (reported line 21)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · check-call.sh (reported line 22)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · phone-call.sh (reported line 37)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · phone-call.sh (reported line 38)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · phone-call.sh (reported line 44)May include surrounding context.

sh
# Load API key
if [[ -z "$BLAND_API_KEY" ]]; then
    if [[ -f ~/.clawd/secrets.json ]]; then
        BLAND_API_KEY=$(jq -r '.bland_api_key // empty' ~/.clawd/secrets.json 2>/dev/null)
    fi
fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises shell-based scripts (phone-call.sh, check-call.sh, bland.sh) but does not declare any tool scope or allowed-tools restrictions. That omission weakens user and platform visibility into what execution capabilities the skill requires and increases the chance of unintended shell access or command execution in a broader runtime than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends sensitive data—including phone numbers, call objectives/content, transcripts, and possibly recordings—to a third-party service, but the description lacks a prominent privacy warning or consent notice. Users may disclose personal or regulated information without understanding that it leaves the local environment and is retained/processed by Bland AI.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
## Setup Required

### 1. Create Bland AI Account
1. Go to https://app.bland.ai
2. Sign up with email
3. Add payment method (or use free trial credits)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bland.sh (reported line 34)May include surrounding context.

sh
fi
fi

API_BASE="https://api.bland.ai/v1"

# Helper function for API calls
api_call() {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · check-call.sh (reported line 59)May include surrounding context.

sh
fi
fi

API_BASE="https://api.bland.ai/v1"

# Helper function for API calls
api_call() {

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bland.sh (reported line 43)May include surrounding context.

sh
local data="$3"
    
    if [[ -n "$data" ]]; then
        curl -s -X "$method" "$API_BASE$endpoint" \
            -H "Authorization: $BLAND_API_KEY" \
            -H "Content-Type: application/json" \
            -d "$data"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This shell script sends user-supplied JSON and call-analysis prompts to the Bland AI API via curl, which may include phone numbers, transcripts, or other sensitive information. While the code performs the network action, it does not provide any explicit user-facing warning about transmitting that data to a third-party service beyond terse usage comments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for placing AI-powered calls and reporting back with transcripts, focused on booking or inquiries on the user's behalf. This script also supports listing recent calls, analyzing arbitrary completed calls, and stopping ongoing calls, which are broader account-level call-management operations not conveyed by the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script retrieves and prints highly sensitive call data, including phone numbers, transcripts, summaries, and recording URLs, directly to stdout with no minimization, masking, consent check, or privacy warning. In agent environments, stdout is often logged, surfaced to other tools, or stored in history, which can unintentionally expose personal or confidential call contents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The code transmits user-supplied phone numbers, task instructions, and an authorization credential to an external API endpoint. External transmission is expected for this skill, but it is still security-relevant because the task may contain sensitive personal or business information and the action causes a real-world outbound call.

Content

Scanner excerpt · phone-call.sh (reported line 155)May include surrounding context.

sh
echo "📝 Task: $TASK"
echo ""

RESPONSE=$(curl -s -X POST "https://api.bland.ai/v1/calls" \
    -H "Authorization: $BLAND_API_KEY" \
    -H "Content-Type: application/json" \
    -d "$REQUEST_BODY")

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The code transmits user-supplied phone numbers, task instructions, and an authorization credential to an external API endpoint. External transmission is expected for this skill, but it is still security-relevant because the task may contain sensitive personal or business information and the action causes a real-world outbound call.

Content

Scanner excerpt · phone-call.sh (reported line 155)May include surrounding context.

sh
echo "📝 Task: $TASK"
echo ""

RESPONSE=$(curl -s -X POST "https://api.bland.ai/v1/calls" \
    -H "Authorization: $BLAND_API_KEY" \
    -H "Content-Type: application/json" \
    -d "$REQUEST_BODY")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This script sends a phone number and free-form task text to a third-party calling provider and initiates a real phone call immediately, without an explicit confirmation prompt or strong privacy notice at execution time. In an agent skill context, that increases the risk of unintended calls, disclosure of personal or sensitive instructions, and actions taken on behalf of the user without sufficient friction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The stated purpose is making AI-powered phone calls via Bland AI, but the implementation also reads credentials from ~/.clawd/secrets.json when the environment variable is absent. Accessing a local secrets store is not mentioned in the manifest and is not inherent to the user-facing purpose described there.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script automatically reads an API key from ~/.clawd/secrets.json if BLAND_API_KEY is not already set. Although functional, this access to locally stored credentials is only implied by an internal comment and is not clearly disclosed in user-facing help or output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest describes a skill for making AI-powered phone calls and reporting back transcripts. While network access to Bland AI is expected, reading from ~/.clawd/secrets.json is an additional local-file access capability that is not justified by the stated phone-calling purpose itself and is not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.