Telecom Agent Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:07 AM UTC
• Version: 0.1.5

Overview

This telecom skill is purpose-aligned but needs review because it can trigger bulk calling, recording, transcript access, and Twilio onboarding without enough scoping or privacy detail.

Review this carefully before installing. Use only a pinned and reviewed version, limit Twilio credentials, set spending and destination controls, require explicit human approval for campaigns and calls, and confirm recording consent, transcript retention, and access-control policies before using it with real callers or customer data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:37
• Finding: Installation of a Mutable Remote Skill Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37-46 **Vulnerability Type**: Remote payload retrieval from an unpinned external repository **Risk Level**: High ### Vulnerable Code ```markdown ### 1. Installation ```bash /install https://github.com/kflohr/telecom-agent-skill ``` ### 2. Setup ```bash telecom onboard # Follow the wizard to link your Twilio account. ``` ``` ### Technical Analysis The installation instruction retrieves a Skill directly from a mutable GitHub repository. It does not pin the source to an immutable commit, verify a cryptographic checksum, validate a signature, or include the retrieved implementation in the audited project. Consequently, the code or instructions ultimately loaded by `/install` can differ from what was available during this audit. The local artifact contains only `SKILL.md`, so the external Skill implementation and the resulting `telecom` executable could not be inspected. The subsequent onboarding step directs the user to link a Twilio account. This creates a sensitive trust boundary because a remotely retrieved component may receive access to a billable telecommunications service. The document also advertises bulk calling, global dialing, recordings, transcripts, and remote administration, increasing the potential impact of an upstream compromise. ### Attack Path 1. An attacker compromises the referenced GitHub account or repository, or otherwise gains the ability to modify its default branch. 2. The attacker inserts malicious Skill instructions, installation logic, or executable components into the repository. 3. A user or agent follows `SKILL.md` and runs `/install` against the mutable repository URL. 4. The installer retrieves the attacker-controlled revision because no immutable commit, signature, or checksum is required. 5. The user runs `telecom onboard` and links a Twilio account. 6. The malicious component operates with whatever local and Twilio permissions were granted, potentia ...[truncated 786 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation to a specific, reviewed Git commit rather than a mutable repository branch. 2. Publish and verify a cryptographic checksum or signed release before loading or executing the Skill. 3. Vendor the reviewed implementation into the project so its scripts, dependencies, and runtime behavior can be audited together with `SKILL.md`. 4. Require explicit confirmation before executing downloaded code or linking any external service account. 5. Use narrowly scoped Twilio credentials with only the permissions required for the intended operations. 6. Apply destination restrictions, call-rate limits, spending caps, and alerts at the Twilio account level. 7. Separate read-only monitoring credentials from credentials capable of placing calls or changing configuration. 8. Document the files installed by `/install`, the permissions requested during onboarding, and the storage and access controls for recordings, transcripts, and logs. 9. Re-audit every upstream revision before updating the pinned commit. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill states that it "Records audio automatically for quality assurance" but does not present any user-facing warning, consent requirement, or jurisdictional compliance notice. In a telecom/public telephone network context, undisclosed recording can create serious privacy, legal, and regulatory exposure, especially across regions with two-party consent laws.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The ChatOps example uses a very broad natural-language trigger ("Bot, create a campaign...") without any stated activation boundary, authorization check, or confirmation requirement. In a telecom skill that can initiate bulk calling, ambiguous trigger phrases raise the risk of accidental or prompt-injected campaign creation, making the context more dangerous than a generic automation skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises access to full call transcripts and persistent storage of logs in an operator console, but it does not include a privacy warning, retention policy, access control expectations, or handling guidance for sensitive data. Because transcripts and telecom logs can contain personal, financial, or regulated information, silent persistence and retrieval materially increase privacy and insider-abuse risk.

Static analysis

No suspicious patterns detected.