Security audit

Clawcall Phone

Security checks for vulnerabilities and agentic risk

Overview

This phone skill should go to Review because it appears to combine real calls, local personal/task context, recordings, and external processing without enough scoping or consent controls.

Install only if you are comfortable with the skill handling real phone calls and potentially using local profile, memory, task, and call content. Before enabling it, restrict any listener or agent URL to trusted local or HTTPS endpoints, confirm who can place or receive calls, disable broad local-context injection unless needed, and establish consent and retention rules for recordings and third-party calls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares required environment variables in metadata but, per the finding, does not declare corresponding permissions for env access. This creates a transparency and governance gap: the skill can depend on sensitive credentials without clearly signaling that capability in its permission model, which can lead to over-trust and unsafe deployment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill is described as a telephony integration, but the finding indicates it also reads local profile/memory files and queries cron/background-task state to personalize phone responses. That mismatch is dangerous because it expands data access and disclosure beyond user expectations, increasing the chance that sensitive local context is exposed over phone calls or sent to the external ClawCall service.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The endpoint allows any caller who can reach the local HTTP service to ask about cron jobs and background tasks, exposing broader host/task-state information unrelated to basic phone call handling. In the context of a telephony bridge, this creates an information disclosure channel that could reveal scheduled activity, operational state, or sensitive task metadata to an untrusted caller.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The third-party calling feature allows the agent to place calls and supply an objective and contextual details to external parties, but it does not explicitly warn that personal or sensitive user data may be shared. In this context, that omission is significant because the core function is autonomous communication with third parties, making accidental privacy leakage highly plausible.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: Caller message content is forwarded to an external or local model process, which may send data to a gateway-backed service depending on configuration. Because this file provides no disclosure, consent, or data-handling controls, sensitive spoken content may be transmitted or retained outside the immediate call-processing boundary.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The code builds a model prompt from profile data and contextual information in addition to the caller's message, increasing the chance that personally sensitive or operationally sensitive information is exposed to the model backend. In a phone-assistant skill, combining identity, user details, and contextual summaries with free-form call content broadens data exposure beyond what the caller may reasonably expect.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This code assembles sensitive profile data, notes, timezone, and potentially a MEMORY.md excerpt into call context without any visible consent check, purpose limitation, or disclosure boundary in the code path. In a phone skill, that creates a real privacy risk because personal data may be surfaced to a caller or downstream model when only a narrow subset is needed.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The manifest explicitly advertises autonomous calls to third parties, scheduled briefings, and callbacks, but provides no corresponding warning about consent, privacy, misdialing, harassment, or unintended contact risks. In a phone/voice skill, those omissions materially increase the chance of misuse or user surprise because the capability can directly reach real people outside the initiating user.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Inbound caller messages are forwarded to a configurable external/local HTTP endpoint (`CLAWCALL_AGENT_URL`) with no authentication, allowlist, or user-consent mechanism in this component. Because call content may contain sensitive spoken data, misconfiguration or use of a non-local/non-TLS endpoint could expose private information to unintended services.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The documentation explicitly states that the local bridge builds prompts using local user info, cron jobs, tasks, and optional memory, and elsewhere instructs sending call messages and responses to a remote API. That creates a real privacy/security risk because potentially sensitive personal data and call content may be transmitted off-device without any explicit warning, consent guidance, minimization guidance, or retention/security expectations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation describes retrieval of hosted call recordings via Twilio URLs but provides no warning about call recording consent, storage duration, access control, or third-party hosting implications. In a phone-call skill, recordings are especially sensitive because they may contain personal, financial, or authentication information, so omitting privacy and retention guidance materially increases misuse risk.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bridge/phone-agent-server.js:82

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bridge/phone-context.js:31

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: listener/clawcall-listener.js:170