Security audit

Phone Call Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent phone-call-agent purpose, but it asks users to run unpinned remote Docker code with sensitive calling credentials and lacks enough privacy guidance for call transcripts and webhooks.

Review this carefully before installing. Use a pinned commit or release, inspect the Docker Compose file and images before adding credentials, use narrowly scoped and revocable API keys, avoid unnecessary webhooks, require consent or notice where calls are recorded/transcribed, and define retention/deletion rules for transcripts and summaries.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:26
Finding: Execution of Mutable Code Retrieved from an External Repository
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:177
Finding: Unpinned Python Dependency Installation
Content: View full analysis
=1.0.0 ``` ### Technical Analysis The instruction accepts any available `mcp` package version equal to or newer than 1.0.0. It does not use an exact reviewed version, a lockfile, package hashes, or a controlled package index. This open-ended constraint allows future releases to be selected automatically. A compromised package release, maintainer account, package index, or dependency in the transitive dependency tree could therefore introduce code that was never reviewed with this Skill. Python packages may execute build-related code during installation, and their application code will execute when the configured MCP server is subsequently started. No dependency manifest, lockfile, package hash, or vendored package source is present in the audited artifact. ### Attack Path 1. An attacker compromises a permitted future release of `mcp`, one of its transitive dependencies, or the package distribution channel. 2. The attacker publishes malicious package content under a version satisfying `>=1.0.0`. 3. A user executes the documented `pip install` command. 4. The package resolver selects and installs the compromised version. 5. Malicious code executes during package build or installation, or later when the MCP server imports and runs the package. 6. The code accesses data and privileges available to the Python environment, including relevant files, environment variables, network access, and application data. ### Impact Assessment Successful exploitation could run arbitrary Python code under the account performing the installation or operating the MCP server. Potentially affected assets include the user's Python environment, MCP configuration, accessible local files, service credentials available to the process, and call-related data handled b ...[truncated 137 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
bash
git clone https://github.com/Littlesheepxy/phone-call-agent cd phone-call-agent cp .env.example .env # Fill in .env with your API keys (see Configuration below) docker compose up

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
bash
git clone https://github.com/Littlesheepxy/phone-call-agent cd phone-call-agent cp .env.example .env # Fill in .env with your API keys (see Configuration below) docker compose up

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
bash
git clone https://github.com/Littlesheepxy/phone-call-agent cd phone-call-agent cp .env.example .env # Fill in .env with your API keys (see Configuration below) docker compose up

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill prominently advertises returning full call transcripts and outcomes to the operator, but it does not present any clear privacy, consent, retention, or lawful-intercept warning to end users or call recipients. In a voice-calling context, this is more dangerous because calls may contain personal, contractual, or sensitive information, and participants may not expect recording and summarization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The webhook feature sends transcript and summary JSON to an arbitrary external URL, but the documentation does not warn about sensitive data handling, transport protections, authentication, or retention risks. In this skill's context, webhook delivery expands the exposure surface for potentially sensitive call content beyond the local deployment.
Content: No source excerpt is available for this finding.

Rp1

Low

Category: MCP Rug Pull
Confidence: 60% confidence
Finding: pip install without ==version installs the latest release, which could include malicious changes.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:223