Security audit
google-voice-caller
Security checks for vulnerabilities and agentic risk
Overview
The skill's code matches its stated purpose (automating Google Voice calls using a headless browser and local audio), but there are several mismatches and operational risks—undeclared dependencies, an explicit requirement to drop a Google cookies JSON (credential material) into the skill directory, and autonomous call/record capability—so you should be cautious before installing or granting it access to credentials.
This skill will actually place real phone calls and record them using your Google session cookies. Before installing: (1) Do not drop your Google credentials or session tokens into the skill directory unless you fully trust the code and operator. The required cookie file is effectively a credential—treat it like a password. (2) Confirm and install the external dependencies it expects (chromium at /usr/bin/chromium, ffmpeg, edge-tts, whisper, Node and puppeteer-core). The registry metadata does not declare these, so missing packages can cause failures or surprises. (3) If you don't want the agent to make calls without your approval, disable autonomous invocation for this skill or require explicit confirmations. (4) Consider running this skill in an isolated environment (container or VM) and inspect the cookie file contents to ensure it contains only session cookies you intend to use. (5) Review local laws and privacy rules about making/recording calls. If you need more certainty about safety, ask the author for a package.json, an explicit dependency/install manifest, and an explanation of how to safely create and scope google_voice_cookies.json (e.g., create a dedicated Google account with limited permissions/balance).
Static analysis
No suspicious patterns detected.