Google Voice

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.3.0

Overview

This skill is for Google Voice automation, but it gives an agent broad access to private messages, texting, calling, recording, and raw authenticated API calls.

Install only in a trusted local workspace, preferably with a dedicated Google Voice account or isolated browser profile. Avoid gv_raw_call, gws mode, GV_COOKIE, GV_AUTHORIZATION, and cookie exports unless you specifically need them. Confirm exact recipients, message text, phone numbers, and recording consent before use, and treat HAR files, SMS exports, cookies, API keys, OAuth tokens, transcripts, and recordings as secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents capabilities to read local files/HAR captures, access environment variables containing API keys or auth material, and make authenticated network requests, but it does not declare corresponding permissions. This mismatch weakens security review and sandboxing because operators may approve or run the skill without realizing it can access sensitive browser-session data, message records, and communication endpoints.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The MCP server exposes a generic `gv_raw_call` tool that allows callers to invoke arbitrary Google Voice API paths with arbitrary request bodies, which substantially exceeds the narrowly described read/send workflow. In the context of an agent-accessible tool, this bypasses any higher-level guardrails the skill author may have intended and creates a broad capability surface for unauthorized message access, account actions, or abuse of undocumented endpoints using the user's live session or credentials.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code executes a local external binary (`gws auth export`) and consumes exported OAuth refresh credentials, which gives the skill a broader host and credential-access capability than is necessary for normal Google Voice browser automation. In an agent setting, this can silently escalate from using an existing browser session to extracting reusable OAuth secrets from the local environment, increasing the risk of credential theft or misuse beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script reads a Google Voice HAR file and prints request-body samples from sensitive voiceclient API calls to stdout. Although it attempts some redaction, the regex-based masking is incomplete and brittle, so phone numbers, message contents, identifiers, tokens, or other private request data may still be exposed in terminal logs, CI output, shell history capture, or shared transcripts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script records call audio via getUserMedia/MediaRecorder and writes it to a fixed file path on disk without any in-script disclosure, confirmation, or consent handling for recording. In the context of a Google Voice automation skill that can place calls and inject audio, silent recording materially increases privacy, legal, and compliance risk because operators may capture sensitive conversations without adequate notice or jurisdiction-specific consent checks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill reads sensitive OAuth refresh credentials, exchanges them for access tokens, and transmits them to Google endpoints without any user-facing approval or warning at the point of use. In a local agent ecosystem, silent credential access is risky because users may believe the tool only automates an existing browser session, while it can actually consume reusable secrets and perform authenticated operations on their behalf.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/google-voice-mcp.js:39

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/google-voice-mcp.js:9

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/google-voice-sms-records.js:3

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/google-voice-start-call.js:5

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/google-voice-mcp.js:44