ClawHub
Back to skill

Security audit

Phone Call Agent

Security checks across malware telemetry and agentic risk

Overview

This is a coherent phone-call skill, but it gives an AI agent real calling, public call-link, transcript, and webhook capabilities without enough consent and control guidance.

Review before installing. Use low-privilege API keys, protect the .env file, inspect the external repository before running Docker, require explicit approval before each real call or shared link, tell participants they are speaking with an AI system and may be transcribed, keep public links private and short-lived, and only enable WEBHOOK_URL for an HTTPS endpoint you control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises outbound calling and transcript retrieval but does not clearly disclose in the primary description that conversations may be fully transcribed, summarized, and optionally forwarded to a webhook. This omission increases the risk of non-consensual monitoring or deceptive use, especially because the tool is designed to contact third parties who may not understand that an AI operator will retain and relay their speech.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The share-link workflow explicitly enables anyone to join a browser call with no account, while the documentation fails to present a prominent warning that the recipient's conversation will be captured and returned to the operator. In context, this is more dangerous than a generic omission because the feature is optimized for frictionless contact with third parties, making covert collection of sensitive statements, personal data, or business information much easier.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:223