Clawcall Phone

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.0

Overview

The skill matches its phone-agent purpose, but its runtime exposes caller input and local user context with weak safeguards that could leak data or let a caller abuse the agent.

Review before installing. Use only if you are comfortable with ClawCall handling your phone number, call transcripts, responses, schedules, third-party call objectives, and billing metadata. Keep the bridge bound to 127.0.0.1, do not expose port 4747, prefer the HTTP bridge over CLI mode, avoid Windows use until the shell invocation is fixed, protect CLAWCALL_API_KEY, and require explicit user approval before callbacks, scheduled calls, billing actions, or calls to third parties.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: listener/clawcall-listener.js:272

Finding

Untrusted Remote Caller Input Is Forwarded to a Privileged Agent Session

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: bridge/phone-agent-server.js:191

Finding

Unauthenticated Local Bridge Exposes Private Workspace Context

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: listener/clawcall-listener.js:215

Finding

Windows Shell Invocation Allows Command Injection Through Caller-Controlled Messages

Content

View full analysis

{ const args = ["infer", "model", "run", MODEL_MODE === "local" ? "--local" : "--gateway", "--json", "--prompt", prompt]; if (MODEL) args.splice(4, 0, "--model", MODEL); if (process.platform === "win32") { const child = spawn("openclaw", args, { shell: true, windowsHide: true, stdio: ["ignore", "pipe", "pipe"], }); ``` ### Technical Analysis Node.js documents that using `spawn()` with `shell: true` executes the command through a system shell. Arguments that contain shell metacharacters may consequently be interpreted by the shell rather than treated exclusively as data. In the listener, `message` originates from a remote caller. In the bridge, `prompt` includes the caller's message. Both values therefore cross directly from an untrusted remote source into a shell-backed process invocation on Windows. Characters and constructs meaningful to `cmd.exe`, such as command separators, pipes, redirections, expansions, and quoting sequences, may alter the resulting command. The use of an argument array does not provide the normal `shell: false` safety guarantee on ...[truncated 1314 chars]

Remediation

View remediation

`, `<`, `%`, `^`, quotes, and line breaks. 7. Run the listener and bridge under a dedicated unprivileged operating-system account. 8. Rotate the ClawCall API key and review the host for compromise if the vulnerable Windows path has been exposed to untrusted callers. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: listener/clawcall-listener.js:34

Finding

Configurable Plaintext API Endpoint Can Expose the ClawCall Bearer Credential

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is a bridge service for processing call/message content over HTTP, not a phone-number provisioning or telephony control implementation. Its main behavior is responding to POSTed messages, answering simple greetings, and reporting cron/job/task summaries, with fallback to an LLM via the openclaw CLI. There is no evidence of telephony APIs, dialing, callback scheduling, third-party calling, or phone-number management. While an HTTP bridge could support a phone agent system, the supplied code chunk materially underdelivers and differs from the declared purpose by omitting the core outbound/scheduled calling capabilities and adding undeclared local task/cron inspection behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code does not perform the declared primary phone capability. There is no logic for assigning a phone number, receiving calls, placing outbound calls, scheduling or executing calls, or contacting third parties. Instead, the module gathers context from local markdown files and OpenClaw CLI commands to prepare a summary likely intended for use by some other phone system component. That is a material description-behavior mismatch: the declared purpose is telephony, while the actual code is contextual data aggregation about the user, memory, cron jobs, and background tasks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises concrete phone-system capabilities and call automation behavior. The supplied code chunk merely constructs conversational instructions for a phone assistant response. While it is related to phone-call dialogue, it does not actually provision a phone number, handle call events, place calls, schedule calls, or manage task-completion callbacks. This is a material description-to-behavior mismatch because the primary promised capabilities are absent from the code shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code does support one portion of the description: handling inbound phone interactions by listening for call messages and responding through an agent. However, the declared purpose claims broader telephony capabilities: calling the user back when tasks complete, running scheduled calls, and calling third parties on the user's behalf. None of those outbound or scheduling behaviors are present in this code chunk. The implementation is specifically an inbound-call listener/response bridge, not a general phone-number/calling skill with callback or scheduling features. Therefore the description materially overstates the implemented capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requests sensitive environment variables and documents networked behavior, but it does not declare an explicit tool/permission scope. That weakens least-privilege controls and makes it harder for a host platform to constrain access to secrets and execution capabilities. In a telephony skill that can trigger outbound calls and interact with external APIs, missing scope declarations materially increase risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill instructs sending the user's phone number and agent name to an external service for registration. This is expected for telephony, but it is still an external transmission of personal data and account bootstrap material, and the skill's context makes it more sensitive because the phone number becomes a long-lived routing identifier. The danger is privacy loss or misuse if users are not clearly informed and if transmission scope is broader than necessary.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

3. Call the registration endpoint:

text

POST https://api.clawcall.online/api/v1/register
Content-Type: application/json

{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Polling /calls/listen sends an API key to a remote service and retrieves caller speech content, which may contain sensitive personal or operational information. This is core functionality, but it is still a real data exfiltration boundary from the agent environment to a third party. The telephony context makes this more dangerous because voice interactions often include spontaneous sensitive disclosures.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

for incoming messages manually:

text

GET https://api.clawcall.online/api/v1/calls/listen?timeout=25
Authorization: Bearer {CLAWCALL_API_KEY}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Submitting call responses to /calls/respond transmits the agent's response content and call identifiers to an external service. If the response includes secrets, personal data, or sensitive task outputs, that information leaves the local trust boundary. In this skill, that boundary crossing is intrinsic, so the main risk is insufficient disclosure and data minimization.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

After receiving a message, submit your response:

text

POST https://api.clawcall.online/api/v1/calls/respond/{call_sid}
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The callback endpoint can send task-completion summaries by phone through an external service. Those messages may contain operational details, incident information, or other sensitive outputs from background tasks, creating a strong risk of unintended disclosure if content is not minimized or if the user did not explicitly opt into phone delivery. Because callbacks are proactive, the user may receive sensitive information in insecure environments.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

When a background task finishes and you need to notify the user by phone:

text

POST https://api.clawcall.online/api/v1/calls/outbound/callback
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The recurring-call scheduling flow sends task_context and schedule metadata to an external service on an ongoing basis, yet the instructions do not warn the user that this information may be stored, processed, or repeatedly transmitted by a third party. Because the calls recur automatically, accidental oversharing can persist over time and amplify privacy impact beyond a one-off request.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

Scheduling recurring calls transmits cron schedule, label, task context, and timezone to an external service. This can reveal habits, routines, work patterns, and sensitive briefing topics over time. The ongoing nature of recurrence raises the privacy impact compared with a one-time API call.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

Scheduling a Recurring Call (Pro tier)

text

POST https://api.clawcall.online/api/v1/calls/schedule
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The schedule deletion endpoint is also an outbound transmission using the API key, but it mainly carries an identifier for cleanup rather than new sensitive content. It is lower risk than the create/listen/respond flows, though compromise of the API key still matters. The danger here is mostly part of the broader secret-handling and third-party reliance model.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

Common patterns: every weekday 8am `"0 8 * * 1-5"` · daily 9am `"0 9 * * *"`.

To cancel: `DELETE https://api.clawcall.online/api/v1/calls/schedule/{id}`

**Requires Pro tier.**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to place autonomous third-party calls and pass objective/context data to an external telephony service, but it does not require an explicit warning or confirmation about disclosure of personal or sensitive information to outside parties. This can lead to unauthorized sharing of names, appointment details, phone numbers, or other private context during real-world calls, which is especially risky because the action affects external humans and persists outside the local system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The third-party outbound call endpoint sends a destination number plus objective/context to an external service that then contacts another person. This is a high-risk transmission because it may disclose private user information to both ClawCall and the called third party, and can trigger real-world actions on the user's behalf. The skill context makes this especially dangerous due to autonomy and social-engineering potential.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

Calling a Third Party (Pro tier)

text

POST https://api.clawcall.online/api/v1/calls/outbound/third-party
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Querying account and usage transmits the API key to the external service and returns metadata about the account. This is expected account-management behavior and lower sensitivity than call content, but it still expands reliance on an external provider and secret handling. On its own, it is a modest privacy/security concern rather than a severe flaw.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

Account & Usage

text

GET https://api.clawcall.online/api/v1/account
Authorization: Bearer {CLAWCALL_API_KEY}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

Changing voice transmits an authenticated preference update to the external service. The content is not highly sensitive, but it still uses the API key and confirms external control over account behavior. This is low impact unless combined with broader secret compromise.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

Changing Voice

text

POST https://api.clawcall.online/api/v1/account/voice
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The billing checkout request transmits authenticated account information to obtain payment instructions. While expected, it introduces financial workflow risk and dependency on a third-party response for wallet/payment details. Users could be exposed to billing confusion or fraud impact if this flow is not clearly authenticated and explained.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

Step 1 — Get payment address and amount:

text

POST https://api.clawcall.online/api/v1/billing/checkout
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Submitting a blockchain transaction signature to verify payment shares financial transaction metadata with the external service. This is not necessarily dangerous by itself, but it creates a link between the user's account and on-chain activity and should be treated as sensitive billing information. In combination with telephony account identity, it can increase traceability.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

Step 3 — Submit transaction signature to confirm:

text

POST https://api.clawcall.online/api/v1/billing/verify
Authorization: Bearer {CLAWCALL_API_KEY}
Content-Type: application/json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The API-key recovery flow sends email and phone number to the external registration endpoint to rotate credentials. This is a sensitive account-recovery action because it couples personal identifiers with credential issuance. If misused or triggered without clear consent, it could aid account takeover or expose recovery details.

Content

Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.

Re-register with the same email to rotate the key:

text

POST https://api.clawcall.online/api/v1/register
Content-Type: application/json

{

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes a telephony bridge for receiving and placing calls, but this file also invokes the openclaw CLI via spawn/execFile to perform model inference. Launching subprocesses is not an obvious requirement of a phone-number/call-control skill as stated, and represents a broader execution capability than the telephony purpose alone justifies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The endpoint can disclose task and cron summaries over HTTP based solely on message content, with no authentication, authorization, or user confirmation visible in this file. Because this is a phone-oriented bridge, the leaked data may include reminders, schedules, and task context that reveal user behavior or internal operations to an unauthorized party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code constructs a prompt from the caller message and contextual data, then passes it to the openclaw model runner with --gateway or --local. There is no visible warning, prompt, or explanatory comment informing users that their spoken content and derived context may be transmitted to another process or potentially a gateway-backed model service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The phone context builder conditionally reads USER.md, IDENTITY.md, and especially MEMORY.md from the workspace and packages their contents into contextText for phone interactions. In a telephony skill, this creates unnecessary data exposure risk because caller-triggered prompts like 'who am i' or 'prefer' can cause long-term memory and profile information to be surfaced into call flows or downstream model/tool context without clear minimization or consent boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description combines several broad behaviors—receiving inbound calls, calling the user back, running scheduled briefings, and autonomously calling third parties—without defining what triggers each action or what approval is required. For a skill that interfaces with real phone numbers, ambiguous invocation scope materially increases risk because the agent could be interpreted as authorized to initiate calls beyond the user's intended task, enabling abuse or unauthorized outreach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description explicitly advertises autonomous outbound calling, scheduled briefings, callbacks, and calls to third parties, but provides no warning about consent, billing, privacy, or misuse risks. In a telephony skill, omission of these constraints is dangerous because users may enable a capability that can contact real people or numbers without clear guardrails, increasing the chance of spam, harassment, data leakage, or unexpected charges.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bridge/phone-agent-server.js:82

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bridge/phone-context.js:31

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: listener/clawcall-listener.js:170