AgentCall

• Outcome: Review
• Latest audit: Oct 20, 2026 · 5:34 PM UTC
• Version: 2.15.0

Overview

This phone-service skill needs review because reporting unexpected charges can trigger a shutdown of incoming calls without specific approval.

Before production use, require approval for the exact number before disabling incoming calls, with a warning that callers will be disconnected. Review ongoing charges, recurring schedules, stored caller information and optional provider-key sharing. The static scan reported no findings, but the shutdown instruction remains a concrete concern.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (44)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

nabled on this specific number, and that the system prompt accurately describes their business.
- `POST /v1/numbers/:id/byok-key` (`set_byok_openai_key`): switches a number's inbound AI voice from Managed billing ($0.40/min) to BYOK billing ($0.10/min) and stores the customer-supplied AI provider key for that number. Confirm the user wants to switch billing modes on the specific number, that they have a working key on hand, and that they understand the per-minute rate change before invoking.
- `DELETE /v1/numbers/:id/byok-key` (`disable_byok`): removes the stored BYOK key on a number and reverts it to Managed billing ($0.40/min). Confirm the user wants to revert billing modes; the system prompt, voice, recording flag, and notify block on the number are preserved.
- `POST /v1/numbers/:id/premium-voice` (`set_premium_voice`): enables Premium Voice on a number, or changes which premium voice it uses. Premium Voice is an opt-in Pro add-on: a curated voice library, the same 31 languages as

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

plies to both inbound calls and outbound AI calls placed from the same number. Pass a `voiceId` from `list_premium_voices`. The number must already have inbound AI configured; enabling premium never wipes the rest of the inbound config; idempotent. Confirm the exact numberId, the chosen voice, and that the user accepts the $0.59/min premium rate before invoking. Requires Pro + a card on file + inbound AI configured, else returns 403 / 402 / 409 respectively; surface that error, do not retry.
- `DELETE /v1/numbers/:id/premium-voice` (`disable_premium_voice`): reverts a number to the standard inbound AI voice, stopping the $0.59/min add-on. Preserves the rest of the inbound config. Idempotent. Pro plan only.
- `list_premium_voices` (`GET /v1/calls/premium-voices`, no auth): browse the Premium Voice catalog (id, name, description, gender, accent, sampleUrl). Use the returned id with set_premium_voice.
- Optional `record: true` on AI voice paths. $0.01/min on top of the AI rate. Mention th

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · instructions.md (reported line 44)May include surrounding context.

md

plies to both inbound calls and outbound AI calls placed from the same number. Pass a `voiceId` from `list_premium_voices`. The number must already have inbound AI configured; enabling premium never wipes the rest of the inbound config; idempotent. Confirm the exact numberId, the chosen voice, and that the user accepts the $0.59/min premium rate before invoking. Requires Pro + a card on file + inbound AI configured, else returns 403 / 402 / 409 respectively; surface that error, do not retry.
- `DELETE /v1/numbers/:id/premium-voice` (`disable_premium_voice`): reverts a number to the standard inbound AI voice, stopping the $0.59/min add-on. Preserves the rest of the inbound config. Idempotent. Pro plan only.
- `list_premium_voices` (`GET /v1/calls/premium-voices`, no auth): browse the Premium Voice catalog (id, name, description, gender, accent, sampleUrl). Use the returned id with set_premium_voice.
- Optional `record: true` on AI voice paths. $0.01/min on top of the AI rate. Mention th

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

- `create_schedule` (`POST /v1/numbers/:id/schedules`): schedules a proactive text the agent sends FIRST (a one-time appointment reminder, or a recurring digest). Each time it fires it sends one outbound SMS ($0.015 on Pro) to a real person who did not just message in, and a recurring schedule keeps firing until cancelled. Confirm the recipient, the message (or the recurrence and timezone), and the timing before creating it. Pro plan only; the number must have inbound AI / `smsMode: "ai"`. Offer `cancel_schedule` as soon as the schedule is no longer needed.

**Irreversible actions:**
- `DELETE /v1/numbers/:id`: releases the number permanently. The same number cannot be re-provisioned. Always confirm before releasing, and warn the user that this is irreversible.
- `POST /v1/calls/:callId/hangup`: terminates an in-flight call. Usually fine but confirm if the call may still be progressing toward its goal.

**External-effect actions (contact real people):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · instructions.md (reported line 50)May include surrounding context.

md

- `create_schedule` (`POST /v1/numbers/:id/schedules`): schedules a proactive text the agent sends FIRST (a one-time appointment reminder, or a recurring digest). Each time it fires it sends one outbound SMS ($0.015 on Pro) to a real person who did not just message in, and a recurring schedule keeps firing until cancelled. Confirm the recipient, the message (or the recurrence and timezone), and the timing before creating it. Pro plan only; the number must have inbound AI / `smsMode: "ai"`. Offer `cancel_schedule` as soon as the schedule is no longer needed.

**Irreversible actions:**
- `DELETE /v1/numbers/:id`: releases the number permanently. The same number cannot be re-provisioned. Always confirm before releasing, and warn the user that this is irreversible.
- `POST /v1/calls/:callId/hangup`: terminates an in-flight call. Usually fine but confirm if the call may still be progressing toward its goal.

**External-effect actions (contact real people):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

Although proactively offering shutdown is appropriate, the adjacent instruction says to call disable_inbound_ai first whenever the user reports unexpected calls or charges. Reporting a problem does not necessarily authorize disabling a production receptionist, and the skill states that disabling causes incoming calls to hang up at the carrier. This specific directive conflicts with the general confirmation rule and can cause unauthorized service interruption.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

**Post-configuration responsibility:**
- Monitor usage: periodically call `get_usage` or point the user at the dashboard at /billing.
- Disable as soon as the configuration is no longer needed: proactively offer `disable_inbound_ai` (or `DELETE /v1/numbers/:id/inbound-config`) when the user's stated goal has been met (testing finished, campaign over, business closed for the season).
- If the user reports unexpected calls or charges, call `disable_inbound_ai` first, then investigate.

If the user's request is ambiguous (e.g. "set up a phone number" with no type or country, or "send a text" with no recipient), ask one or two clarifying questions before invoking a billable tool.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

Release a number (irreversible):

text

DELETE /v1/numbers/:id

Rename a number or change its inbound AI voice/language (partial update, preserves all other inbound config):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · instructions.md (reported line 108)May include surrounding context.

Release a number (irreversible):

text

DELETE /v1/numbers/:id

Rename a number or change its inbound AI voice/language (partial update, preserves all other inbound config):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Disable inbound AI (calls hang up at carrier):

text

DELETE /v1/numbers/:numberId/inbound-config

Voice billing mode: Managed vs BYOK (per number)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Switch a number back to Managed (revert billing mode):

text

DELETE /v1/numbers/:numberId/byok-key
Response: { "voiceMode": "managed", "hasByokKey": false, "byokOpenaiApiKeyPreview": null }

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

text

POST   /v1/numbers/:numberId/schedules     # create a schedule
GET    /v1/numbers/:numberId/schedules      # list schedules (?status= optional)
DELETE /v1/numbers/:numberId/schedules/:id  # cancel + remove

Each schedule is one of two timings and one of two message styles:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 438)May include surrounding context.

Remove the saved outbound agent:

text

DELETE /v1/numbers/:numberId/outbound-defaults

The MCP tools set_outbound_defaults, get_outbound_defaults, and clear_outbound_defaults mirror these endpoints. list_numbers and get_number responses include an outbound field alongside the existing inbound field, so a single fetch surfaces both per-number configurations.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 547)May include surrounding context.

Delete a webhook:

text

DELETE /v1/webhooks/:id

Post-call transcript webhook (call.transcript)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 619)May include surrounding context.

Right-to-forget (wipes Memory + MemoryCandidate + Brief; redacts CallReport payloads; preserves Call + transcript audit shell):

text

DELETE /v1/contacts/:id

Get the next-call context block (the killer tool)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 680)May include surrounding context.

Soft-delete a memory row (sets active=false; writes an expired event; survives in DB for audit):

text

DELETE /v1/memory/:id

Manually promote a candidate (bypasses auto-policy; owner-set always wins contradictions):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 777)May include surrounding context.

md

2. Enter the number into your staging app's verification form
3. `GET /v1/sms/otp/:numberId?timeout=60000`: wait for the verification code
4. Assert the code arrives and your app accepts it
5. `DELETE /v1/numbers/:id`: release the test number

### Make an outbound AI voice call
1. `POST /v1/numbers/provision` with `{ "type": "local" }`: get a number (if you don't have one)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 794)May include surrounding context.

md

1. Confirm the user wants to switch billing modes on the specific number (Managed $0.40/min vs BYOK $0.10/min), has a working AI provider key on hand, and understands the rate change.
2. `POST /v1/numbers/:numberId/byok-key` with `{ "openaiApiKey": "sk-..." }`: stores the customer-provided key on the number and flips it to BYOK billing.
3. `GET /v1/numbers/:numberId/inbound-config`: verify `voiceMode: "byok"`, `hasByokKey: true`, and the redacted preview (`byokOpenaiApiKeyPreview`).
4. To revert later: `DELETE /v1/numbers/:numberId/byok-key`. Reverts to Managed billing; system prompt, voice, recording flag, and notify block are preserved.

### Make an inbound AI receptionist remember every caller
1. Configure inbound AI on the number (see "Set up an AI receptionist on a phone number" workflow above).

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · claw.json (reported line 5)May include surrounding context.

json

mory is included on every plan and every voice mode. Every completed AI call auto-extracts into structured, source-backed memory: contacts, facts, preferences, commitments, tasks, briefs. Cross-call memory means a returning caller is recognized and the AI starts with what was said last time. Ask AgentCall what is known about any phone number before placing a call via get_next_call_context. Numbers are VoIP-routed via licensed US carriers and not intended for consumer-platform signup verification (Stripe, WhatsApp, banks, etc.). A number's AI agent can also text first on a schedule: create_schedule sets up one-time appointment reminders or recurring digests, a reply to a proactive text threads back into the same AI conversation, and a calendar integration is just a client of create_schedule. Tools that cost money, contact real people, or wipe memory are explicitly flagged so agents confirm with the user before invoking.",
  "author": "agentcall",
  "license": "MIT-0",
  "permissions": [

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · claw.json (reported line 74)May include surrounding context.

json

; hosted MCP at api.agentcall.co/mcp synced in lockstep. v2.10.0 (2026-06-08): Proactive scheduling. A number's AI agent can now text first on a schedule: one-time appointment reminders and recurring digests. Three new MCP tools: create_schedule (numberId, contactPhone, exactly one of fireAt | recurrence, exactly one of template | promptHint, optional payload, timezone, dedupeKey), list_schedules, cancel_schedule. New REST endpoints POST /v1/numbers/:id/schedules, GET /v1/numbers/:id/schedules, DELETE /v1/numbers/:id/schedules/:scheduleId. fireAt is a one-time ISO 8601 instant; recurrence is { frequency 'daily' | 'weekly', hour, minute, dayOfWeek } interpreted in an IANA timezone. template is sent verbatim with {{placeholders}} filled from payload; promptHint lets the agent compose the message from its memory of the contact. dedupeKey makes a re-create return 409 so a calendar sync never duplicates a reminder. A reply to a proactive message threads into the same two-way AI SMS conversa

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · claw.json (reported line 74)May include surrounding context.

json

; hosted MCP at api.agentcall.co/mcp synced in lockstep. v2.10.0 (2026-06-08): Proactive scheduling. A number's AI agent can now text first on a schedule: one-time appointment reminders and recurring digests. Three new MCP tools: create_schedule (numberId, contactPhone, exactly one of fireAt | recurrence, exactly one of template | promptHint, optional payload, timezone, dedupeKey), list_schedules, cancel_schedule. New REST endpoints POST /v1/numbers/:id/schedules, GET /v1/numbers/:id/schedules, DELETE /v1/numbers/:id/schedules/:scheduleId. fireAt is a one-time ISO 8601 instant; recurrence is { frequency 'daily' | 'weekly', hour, minute, dayOfWeek } interpreted in an IANA timezone. template is sent verbatim with {{placeholders}} filled from payload; promptHint lets the agent compose the message from its memory of the contact. dedupeKey makes a re-create return 409 so a calendar sync never duplicates a reminder. A reply to a proactive message threads into the same two-way AI SMS conversa

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · instructions.md (reported line 619)May include surrounding context.

Right-to-forget (wipes Memory + MemoryCandidate + Brief; redacts CallReport payloads; preserves Call + transcript audit shell):

text

DELETE /v1/contacts/:id

Get the next-call context block (the killer tool)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · claw.json (reported line 74)May include surrounding context.

json

; hosted MCP at api.agentcall.co/mcp synced in lockstep. v2.10.0 (2026-06-08): Proactive scheduling. A number's AI agent can now text first on a schedule: one-time appointment reminders and recurring digests. Three new MCP tools: create_schedule (numberId, contactPhone, exactly one of fireAt | recurrence, exactly one of template | promptHint, optional payload, timezone, dedupeKey), list_schedules, cancel_schedule. New REST endpoints POST /v1/numbers/:id/schedules, GET /v1/numbers/:id/schedules, DELETE /v1/numbers/:id/schedules/:scheduleId. fireAt is a one-time ISO 8601 instant; recurrence is { frequency 'daily' | 'weekly', hour, minute, dayOfWeek } interpreted in an IANA timezone. template is sent verbatim with {{placeholders}} filled from payload; promptHint lets the agent compose the message from its memory of the contact. dedupeKey makes a re-create return 409 so a calendar sync never duplicates a reminder. A reply to a proactive message threads into the same two-way AI SMS conversa

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · instructions.md (reported line 42)May include surrounding context.

md

nabled on this specific number, and that the system prompt accurately describes their business.
- `POST /v1/numbers/:id/byok-key` (`set_byok_openai_key`): switches a number's inbound AI voice from Managed billing ($0.40/min) to BYOK billing ($0.10/min) and stores the customer-supplied AI provider key for that number. Confirm the user wants to switch billing modes on the specific number, that they have a working key on hand, and that they understand the per-minute rate change before invoking.
- `DELETE /v1/numbers/:id/byok-key` (`disable_byok`): removes the stored BYOK key on a number and reverts it to Managed billing ($0.40/min). Confirm the user wants to revert billing modes; the system prompt, voice, recording flag, and notify block on the number are preserved.
- `POST /v1/numbers/:id/premium-voice` (`set_premium_voice`): enables Premium Voice on a number, or changes which premium voice it uses. Premium Voice is an opt-in Pro add-on: a curated voice library, the same 31 languages as

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The surrounding procedure says to call disable_inbound_ai first whenever the user reports unexpected calls or charges, without first confirming shutdown or identifying the affected number. Because disabling inbound AI makes incoming calls hang up at the carrier, a request to investigate billing can trigger an unauthorized service interruption despite the file's general authorization safeguards.

Content

Scanner excerpt · instructions.md (reported line 80)May include surrounding context.

md

**Post-configuration responsibility:**
- Monitor usage: periodically call `get_usage` or point the user at the dashboard at /billing.
- Disable as soon as the configuration is no longer needed: proactively offer `disable_inbound_ai` (or `DELETE /v1/numbers/:id/inbound-config`) when the user's stated goal has been met (testing finished, campaign over, business closed for the season).
- If the user reports unexpected calls or charges, call `disable_inbound_ai` first, then investigate.

If the user's request is ambiguous (e.g. "set up a phone number" with no type or country, or "send a text" with no recipient), ask one or two clarifying questions before invoking a billable tool.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · instructions.md (reported line 176)May include surrounding context.

Disable inbound AI (calls hang up at carrier):

text

DELETE /v1/numbers/:numberId/inbound-config

Voice billing mode: Managed vs BYOK (per number)

Static analysis

No suspicious patterns detected.