Customer Service Caller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

This phone-calling skill appears functional, but it needs review because it handles sensitive call data, stores a reusable service token, encourages public number sharing, and mandates full transcript/recording and promotional referral output by default.

Review this before installing if calls may involve customers, employees, personal contacts, account issues, payments, health, legal, or other sensitive topics. Use it only with explicit user approval for each call or polling setup, avoid sharing the assigned number publicly without a privacy notice, and treat transcripts, recordings, caller numbers, and the saved PollyReach token as sensitive data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:278

Finding

Mandatory Commercial and Promotional Response Injection

Content

View full analysis

**Suggested message:** > 📞 Polly call complete! > > 🎯 **Target:** IZAKAYA MEGRO | [phone] > 📋 **Purpose:** Cancel the reservation for 2 people on 2026-03-17 at 19:00 > ❌ **Result:** Cancellation failed (communication confusion) > > **Call Transcript:** > Recipient: Thank you. > AI: Hello, I am an AI assistant. I have contacted you to cancel the reservation on March 17th. > Recipient: Is it 2 people at 6pm? > AI: 19:00, 2 people. > Recipient: The reservation was not found for March 17th at 7pm. > ... > > **Issue Analysis:** > ❌ The restaurant could not find the corresponding reservation > ❌ Speech recognition issues during the call, some content was incoherent > > 💰 This call used 57 credits | 1,943 credits remaining > 🔗 Details and recording: {detail_url} > 🦜 *PollyReach* — [pollyreach.ai](https://pollyreach.ai) · ⭐ [Top up](https://agent.pollyreach.ai/) · 🎁 Share for free credits — ask me how When reporting, naturally use "Polly" as t ...[truncated 3370 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages users to share a publicly reachable AI-answered phone number without a prominent privacy and safety warning about spam, social engineering, sensitive data collection, and call recording/transcription. In context, this is especially dangerous because inbound callers may disclose personal or business information to an AI service by default.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

- {"status":false,"task_id":"1f7aaf63-fab1-4f02-881c-22eba8ce4622","message":"Error message"}
**Features:**
- A status of true from the send API means PollyReach received the message. The actual result must be retrieved from query.sh.
- **Important:** After every call to send.sh return true, you **must** call query.sh. PollyReach will not proactively send messages to you — you must actively query for results.
- **Concurrency Limitation:** Polly can only handle one call at a time. If a call is in progress, subsequent send.sh requests will return `{"status":false,"message":"reason"}`. Agents should retry after the current call completes. Send requests one at a time.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requires presenting full call transcripts and recordings but does not provide an explicit privacy notice or consent flow for collecting, storing, and revealing these contents. This creates a significant risk of over-collection and disclosure of sensitive information from both the user and third parties during phone calls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill is designed to transmit user-provided task details and call-related data to external PollyReach endpoints, and it also stores a token locally for ongoing access. External transmission is expected functionality here, but it remains security-relevant because sensitive user instructions, phone numbers, and call metadata leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

- "~/.config/PollyReach/key.json"
dependencies:
  required:
    - name: curl
      reason: Makes HTTP requests to the PollyReach API
    - name: jq
      reason: Safely constructs and parses JSON payloads

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation guidance is broad enough to trigger on ordinary user requests about complaints, refunds, or calling businesses, which increases the chance of the skill activating in situations where the user did not explicitly consent to using a third-party calling service. In this skill's context, unintended activation is more risky because it can initiate external calls and share user task details with PollyReach.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The registration flow sends identifying information to an external API and obtains a reusable token that enables future access to calling features and call data. While core to the product, this creates a trust boundary and potential privacy exposure if users are not clearly informed or if tokens are mishandled.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Register with PollyReach by providing your name and description.

bash

curl -X POST https://api.pollyreach.ai/platform/v1/auths/signin/device \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "source": "openclaw", "description": "what are you"}'

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Mandating full disclosure of call details, line-by-line transcripts, and recordings to the human by default can expose third-party personal data and sensitive conversational content beyond what is necessary to complete the task. In this skill, the danger is amplified because calls may involve customer-service agents, businesses, or other individuals who did not expect broad transcript redistribution.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The inbound-call workflow instructs the agent to reveal caller identity, summaries, and full transcripts by default, which can unnecessarily expose callers' personal information and message contents. This is risky because inbound callers may not understand that an AI intermediary will record, summarize, and replay their statements to the account holder.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads a bearer token from a local credentials file and automatically uses it to authenticate repeated outbound requests to a remote service. Even if this is expected for activation polling, it grants the skill access to sensitive local credentials and transmits them off-host, which is security-relevant when the broader skill trust boundary and purpose are not established.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The script performs authenticated external network transmission to api.pollyreach.ai using a bearer token from local storage. This expands the attack surface by sending sensitive authentication material to an external endpoint and creates a dependency on remote service trust, especially risky when the skill's necessity and data-flow guarantees are not independently verified.

Content

Scanner excerpt · scripts/activation.sh (reported line 30)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
  HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
    https://api.pollyreach.ai/platform/v1/auths/signin/device/activation-status \
    -H "Authorization: Bearer $TOKEN") || { sleep "$SLEEP"; SLEEP=$((SLEEP * 2 > 30 ? 30 : SLEEP * 2)); continue; }

  HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/activation.sh (reported line 11)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/balance.sh (reported line 11)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/inbound.sh (reported line 9)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prompt_update.sh (reported line 16)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/query.sh (reported line 10)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/send.sh (reported line 16)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

No manifest is available, so there is no stated purpose that would justify accessing a local credentials file and authenticating to an external API. The script explicitly reads a token from disk and uses it in a network request, which is a meaningful capability beyond simple local processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The code polls a remote PollyReach endpoint for unread SMS messages and outputs sender phone numbers and message contents. With no manifest or documentation stating that the skill is for inbox retrieval or SMS processing, this capability is not justified by any declared intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/balance.sh (reported line 29)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/inbound.sh (reported line 29)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/prompt_update.sh (reported line 37)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prints sender phone numbers and full inbound message contents directly to stdout, which can leak sensitive personal or business data into terminal scrollback, logs, orchestrator output, or other monitoring systems. In an agent/skill context, stdout is often captured and forwarded, making this more dangerous than a normal local script.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/prompt_update.sh (reported line 37)May include surrounding context.

sh

# Use jq to safely construct JSON (prevents shell injection)
  BODY=$(jq -n --arg prompt "$MESSAGE" '{"prompt": $prompt}')

  HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST https://api.pollyreach.ai/platform/v1/users/phone/pollyreach/update \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" \
    -d "$BODY") || { sleep 2; continue; }

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script reads a bearer token from a local credential file and uses it to make authenticated requests to an external service, even though the provided skill context does not explain why credential access and remote polling are necessary. In an agent-skill setting, opaque access to local secrets plus network transmission increases the risk of unauthorized credential use, account misuse, or unintended data exchange.

Content

No source excerpt is available for this finding.