Security audit

FaceTime Auto Call

Security checks for vulnerabilities and agentic risk

Overview

This FaceTime calling skill is mostly purpose-aligned, but it asks for broad Mac UI-control access and can start calls, read contacts, and manipulate notifications with too little containment.

Install only if you intentionally want an agent to control FaceTime through macOS Accessibility. Review the scripts first, require explicit confirmation before every call, avoid using broad contact search unless needed, and consider removing the notification-clearing script and the generic NodeRunner Accessibility wrapper before use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly invokes shell commands and automation workflows but does not declare the permissions required for those capabilities. This is dangerous because it hides the true execution and trust boundary from users and reviewers, especially for a tool that can launch calls, install helper apps, and drive macOS Accessibility automation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior materially understates what the skill does: beyond placing calls, it searches contacts, manipulates notifications/processes, installs a helper app, and guides the user to grant Accessibility permissions. That mismatch is dangerous because users may consent to a simple calling tool without realizing they are authorizing broad local automation powers that can be abused for surveillance, unwanted actions, or persistence-like helper installation.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill’s stated purpose is making FaceTime calls, but it also enumerates full contact details from the Contacts app and prints phone numbers and email addresses. That expands data access beyond the primary action and can expose sensitive personal information to the invoking user or downstream logs without clear necessity or consent boundaries.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Access to the Contacts database is not clearly justified by the advertised auto-call behavior, and the script performs broad searches by name and outputs all matching phone numbers and emails. In an agent context, this makes the skill more dangerous because a simple query can be used to harvest contact information unrelated to initiating a single requested call.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This script performs global Notification Center clearing, which is outside the stated purpose of making FaceTime calls. Dismissing notifications can hide security prompts, MFA requests, alerts, or other user-visible events, reducing user awareness and creating unnecessary system-wide side effects for a calling skill.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script uses killall NotificationCenter and UI automation via osascript/System Events to affect the global notification subsystem, a powerful capability not justified by the skill's stated purpose. This can suppress or remove unrelated system and application notifications, including important security or privacy alerts, making it more dangerous in a skill that otherwise appears limited to initiating calls.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The setup script creates a new local app bundle specifically so the user can grant it Accessibility permissions, enabling UI automation outside the narrow scope of placing a FaceTime call. Accessibility/TCC privileges are powerful on macOS and can be abused to control other applications, click dialogs, and interact with sensitive UI elements, so creating a generic Node wrapper app materially expands attack surface.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad everyday language such as 'Call John' and 'Video call with X,' which can overlap with ordinary conversation and increase the chance of unintended invocation by an agent. In a skill that can initiate communications and automate UI interactions, accidental triggering can cause privacy issues, unwanted outbound calls, and social engineering opportunities.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill asks the user to grant Accessibility permissions and automates FaceTime/notification UI, but it does not present a prominent warning about the sensitivity of those privileges. Accessibility access is highly powerful on macOS and can be used to control other applications and interact with security-relevant UI, so users need explicit risk disclosure before setup.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script reads contact names, phone numbers, and email addresses and displays them, but its usage/help text does not warn users that personal data from Contacts will be accessed and exposed. This lack of transparency creates a privacy risk and increases the chance of inadvertent disclosure through terminal history, logs, screenshots, or agent outputs.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script is explicitly designed to auto-click the FaceTime confirmation notification, bypassing the normal user interaction that would confirm call initiation. In an agent skill, this is more dangerous because it enables placing audio or video calls with little friction, increasing the risk of unintended calls, harassment, or social engineering abuse if invoked improperly.

Static analysis

No suspicious patterns detected.