T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:52- Finding
API Key Disclosed Through Terminal Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Voice.Ai Voice Agents
Security checks for vulnerabilities and agentic risk
Overview
The skill’s core purpose is coherent, but it can change or delete live Voice.ai resources and has weak safeguards around API-key handling.
Review before installing. Use a narrowly scoped Voice.ai API key, do not run the documented echo command for the key, avoid committing .env files, and require explicit confirmation before deploy, delete, knowledge-base deletion, or phone-number changes. Prefer the default HTTPS endpoint unless you have separately verified a custom endpoint is trusted.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
voice-ai-agents-sdk.js:100- Finding
Bearer Token Can Be Transmitted to an Arbitrary Host or Over Plaintext HTTP
- Content
View full analysis
{ const url = new URL(`/api/${API_VERSION}${path}`, this.baseUrl); const isHttps = url.protocol === 'https:'; const httpModule = isHttps ? https : http; const options = { hostname: url.hostname, port: url.port || (isHttps ? 443 : 80), path: url.pathname + url.search, method: method, headers: { 'Authorization': `Bearer ${this.apiKey}`, ``` ### Technical Analysis The SDK accepts an unrestricted `options.baseUrl`, supports both HTTP and HTTPS, and unconditionally attaches the Voice.ai API key as an `Authorization: Bearer` header. No validation requires the destination to use HTTPS, and no host allowlist limits authentication to an expected Voice.ai domain. Consequently, a caller that supplies an untrusted base URL can cause the SDK to disclose the token directly to another host. If an HTTP URL is supplied, the token is also vulnerable to interception or modification by an attacker with access to the network path. The bundled CLI does not expose a base URL argument and uses the default HTTPS endpoint. Exploitation therefore requires another SDK consumer, configuration layer, or compromised integration to provide an unsafe `options.ba ...[truncated 1543 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
export VOICE_AI_API_KEY="your-api-key-here"
text **Method 2: .env File** ```bash # Create .env file in project root echo 'VOICE_AI_API_KEY=your-api-key-here' >> .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The instruction to append the API key directly into a local .env file encourages plaintext secret storage without any accompanying safeguards. If the project directory is shared, backed up insecurely, or accidentally committed, the API key can be exposed and used to manage or deploy voice agents.
- Content
Method 2: .env File
bash # Create .env file in project root echo 'VOICE_AI_API_KEY=your-api-key-here' >> .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The continued .env-based credential example reinforces insecure secret handling and normalizes storing long-lived API keys in plaintext within the project root. In the context of a skill that can create, deploy, and delete agents, compromise of that key enables unauthorized externally impactful actions.
- Content
Method 2: .env File
bash # Create .env file in project root echo 'VOICE_AI_API_KEY=your-api-key-here' >> .envMethod 3: OpenClaw Config
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | Documentation and OpenClaw skill definition |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documentation describes access to environment variables and API-key based authentication, but it does not declare any explicit tool scope or permission boundaries. In an agent framework, undocumented capability to read env/config increases the risk of unintended secret exposure or over-privileged execution because the orchestrator and user are not clearly informed what the skill may access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The feature list advertises destructive and externally impactful actions such as delete, deploy, and phone-number management without requiring explicit confirmation or warning guidance. In conversational systems, absence of confirmation for these operations can lead to accidental service changes, deletion of agents, or activation of outbound phone behavior from ambiguous user input.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
text ### Silent Initialization The SDK automatically initializes when you run any command. No manual setup required after setting the API key. ## 🚀 Quick Start
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
"config": { "api_key": "${VOICE_AI_API_KEY}", "default_model": "gemini-2.5-flash-lite", "auto_deploy": false } }
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases include broad natural-language terms like 'new agent', 'start the bot', and 'show agent' that may match ordinary conversation rather than an intentional request to use this skill. That can cause unintended activation of a skill capable of making external changes, which is especially risky because the skill supports deployment and deletion actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI performs a destructive delete immediately once
delete --idis invoked, with no confirmation prompt,--forcegate, dry-run mode, or undo/recovery flow. In a command-line management tool for live voice agents, this increases the chance of accidental deletion from user error, scripting mistakes, or copied commands, causing service disruption and possible loss of configuration.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
js /** * Delete (disable) an agent * Agent must be paused before being deleted. * Disabled agents are automatically deleted after a grace period. * @param {string} agentId - Agent ID * @returns {Promise<Object>} Deletion confirmation with agent details */
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for creating, listing, deploying, and managing Voice.ai conversational agents and their configurations. This file also exposes separate resource-management capabilities for knowledge bases and phone numbers, which are materially broader product operations rather than obvious implementation details of basic agent management.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The deleteKnowledgeBase method performs a destructive DELETE request, but there is no confirmation prompt, user-facing log, or warning around this irreversible operation. In a code file, destructive operations should include some form of disclosure unless the warning is otherwise visibly provided.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The releasePhoneNumber method performs a potentially disruptive resource-release action, but the code provides no confirmation prompt, visible warning, or user-facing disclosure before sending the request. Releasing a phone number can affect service availability and should be explicitly surfaced to the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises capabilities that can affect live external resources, including deploying voice agents, managing phone numbers, and integrating with MCP, but it does not warn users that these actions may trigger real-world changes or billing-impacting operations. In an agentic environment, missing safety disclosure increases the risk of unintended destructive or costly actions because users may not realize the skill can modify production systems.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
When creating an agent, the code sets language: args.language || 'en', which forces English as the default locale if the user does not explicitly choose one. This is a natural-language locale policy concern because the skill does not offer opt-in language selection before applying the default.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest focuses on creating, managing, and deploying voice agents, plus managing agent configurations. The analytics section adds reporting capabilities for call history, call details, and agent statistics, which are distinct read-oriented operations not mentioned in the stated skill purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file declares multiple supported languages, but the default TTS setting forces English by default. Under the language/locale policy, a fixed language preference can be a concern when not paired with explicit user choice or a documented justification.
- Content
Static analysis
No suspicious patterns detected.