Security audit

Voice.Ai Voice Agents

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate Voice.ai management skill, but it needs review because it can affect live voice agents, phone resources, analytics, and deletions without clear safeguards.

Install only if you intend to let an agent manage Voice.ai resources. Treat deployment, deletion, phone-number changes, and call-history or analytics access as sensitive actions; require explicit confirmation before running them, and do not print or hardcode API keys or bearer tokens.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation instructs users to read and export an API key from the environment, but the skill metadata does not declare corresponding permissions or clearly scope that capability. Hidden or undeclared access to environment-backed secrets weakens transparency and can lead users or orchestrators to grant broader access than intended.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented behavior exceeds the declared purpose by covering additional high-impact operations such as knowledge base management, phone number operations, call-history retrieval, statistics access, and MCP helper configuration. This mismatch reduces informed consent and can cause an agent runner or user to invoke capabilities involving sensitive data, billing, or external effects that were not expected from the skill description.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill exposes a delete operation for agents without any warning, confirmation step, or recovery guidance. In an agentic context, destructive actions can be triggered from ambiguous user phrasing or automation mistakes, resulting in unintended loss of production configurations or service disruption.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill advertises one-click deployment for live phone calls without clearly warning that deployment can create immediate external effects, including user-facing calls, service activation, and potential cost or reputational impact. In an automation setting, this can lead to real-world actions being taken without sufficiently informed approval.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The MCP integration example embeds a bearer token directly in sample code, normalizing hardcoded secrets in documentation. Users may copy this pattern into source control, logs, or shared configs, increasing the risk of credential leakage and downstream compromise of connected external tools.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The manifest advertises capabilities that can trigger real-world external actions—deployment, phone number management, and analytics—without warning the user that these operations may affect live telephony resources or transmit operational data to third-party systems. In an agent skill context, missing disclosure increases the risk of accidental high-impact actions and uninformed consent, especially when the skill is used through natural-language requests.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.