Lunara Voice

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:56 PM UTC
• Version: 1.0.0

Overview

This is a real Lunara Voice integration, but it can place calls, export transcripts, manage keys and webhooks, and automate sensitive follow-up steps without clear confirmation.

Review this carefully before installing. Use only a trusted HTTPS Lunara API URL, prefer a test or least-privilege key, protect the local config file, and do not enable it for regulated or sensitive call data unless you accept that an agent may place calls, read or export transcripts, save analytics/tags, and change webhooks or API keys through the configured account.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: plugin/skills/lunara-voice/SKILL.md:103

Finding

Always-Loaded Skill Forces Unnecessary Autonomous Transcript Processing and Persistent Writes

Content

View full analysis

` and `caller=` every 25-30 seconds. **You MUST use date_from to exclude old calls.** Keep polling until a record appears that matches the phone number AND was created AFTER step 1's timestamp (up to 5 minutes / 10 attempts). Do NOT message the user — poll silently. 4. `lunara_history_detail` with `include_transcript=true` and the **conversation_id f ...[truncated 2492 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: plugin/index.ts:55

Finding

Bearer Credentials and Sensitive API Data Can Be Sent to Arbitrary or Plaintext Endpoints

Content

View full analysis

{ return { Authorization: `Bearer ${cfg.apiKey}`, "Content-Type": "application/json", }; } ``` ```ts async function apiCall( url: string, options: RequestInit, ): Promise<{ status: number; body: any }> { try { const res = await fetch(url, options); let body: any; try { body = await res.json(); } catch { body = { raw: await res.text() }; } return { status: res.status, body }; } catch (err: any) { return { status: 0, body: { success: false, error: `Network error: ${err.message || err}` }, }; } } ``` The associated schema accepts an unrestricted string: ```json "apiBaseUrl": { "type": "string", "description": "Lunara API base URL (e.g. https://lunara-vox-44f11167db7c.herokuapp.com)" } ``` ### Technical Analysis The plugin constructs all API destinations directly from the configured `apiBaseUrl`. It does not parse or validate the URL, require TLS, restrict the hostname, reject embedde ...[truncated 1804 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: plugin/index.ts:81

Finding

API-Key Management Requests Use a Caller-Controlled Email as the Only Client-Side Identity Header

Content

View full analysis

{ if (!cfg.userEmail) { throw new Error( "userEmail is required for API key management. Set plugins.entries.lunara-voice.config.userEmail", ); } return { "X-User-Email": cfg.userEmail, "Content-Type": "application/json", }; } ``` The resulting headers are used for key-management operations without the configured bearer token: ```ts const { status, body } = await apiCall(`${baseUrl(cfg)}/keys`, { method: "POST", headers: sessionHeaders(cfg), body: JSON.stringify({ name: params.name, assistant_id: params.assistant_id || "", }), }); ``` ```ts const { body } = await apiCall(`${baseUrl(cfg)}/keys`, { method: "GET", headers: sessionHeaders(cfg), }); ``` ```ts const { body } = await apiCall(`${baseUrl(cfg)}/keys/${params.key_id}/revoke`, { method: "POST", headers: sessionHeaders(cfg), }); ``` ```ts const { body } = await apiCall(`${baseUrl(cfg)}/keys/${params.key_id}`, { method: "DELETE", headers: sessionHeaders(cfg), }); ``` ### Technical Analysis The client labels these requests as “session” operations, but the constructed request contains no session token, cookie, bearer token, cryptographic signature, or other proof that the caller owns the supplied email address. The value originates from editable plugin configuration. An email address is an identifier, not an authentication credential. If the remote API relies on `X-User-Email` as shown by this client, a caller can substitute another account's email and attempt key-management actions as that user. The ultimate server-side exploitability depends on whether the server independently authenticates these r ...[truncated 1256 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: plugin/index.ts:1452

Finding

Webhook HTTPS Requirement Is Documented but Not Enforced by the Plugin

Content

View full analysis

= {}; if (params.url) updates.url = params.url; if (params.events) updates.events = params.events; if (params.status) updates.status = params.status; if (params.assistant_id) updates.assistant_id ...[truncated 2002 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description frames the bundle as simple install/publish helpers, but the analyzed behavior reportedly includes extensive privileged operations such as API key management, outbound calling, transcript access, analytics mutation, and webhook administration. This mismatch can mislead users and reviewers into enabling a much more powerful integration than expected, increasing the chance of overtrust, unsafe installation, and unreviewed access to sensitive data and external actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The implemented capability set materially exceeds the declared skill purpose. A bundle described as install/publish helpers instead exposes broad operational control over telephony, credential lifecycle, history access, analytics, exports, and webhooks, creating a serious scope-mismatch that can mislead reviewers and users into granting trust to a much more powerful integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The plugin includes API key creation, listing, revocation, and permanent deletion despite a stated helper-bundle purpose. Credential-management features are highly sensitive because they can mint new access, enumerate existing secrets, and disrupt or replace account access if a user invokes them without understanding the true scope of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The plugin can place outbound calls and start or stop campaigns, enabling real-world actions with financial, legal, and reputational consequences. In the context of a misleadingly labeled helper bundle, this increases the risk of unauthorized telephony activity, spam, or accidental campaign execution through misplaced trust or prompt-driven misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These tools retrieve detailed conversation history and transcripts and support single or bulk export in training-ready formats. That creates a direct path for mass exposure of potentially sensitive customer communications and downstream reuse in model training, which is especially dangerous when bundled under an understated description that would not lead users to expect broad data-exfiltration capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The export tools support bulk extraction of conversations in LLM-training and raw formats, which can facilitate large-scale transfer of sensitive communications into external processing pipelines. Without strong warnings, hard limits, or workflow controls, users may unknowingly expose regulated or confidential data for secondary use such as model training.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to place a live API key directly into a local configuration file without warning about secret exposure risks such as plaintext storage, accidental commits, shell history leakage, backups, or overly broad file permissions. Because this is a voice/communications plugin with access to operational and conversational data, compromise of the key could enable unauthorized API use and access to sensitive records or actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level header openly describes a full operational integration, which conflicts with the narrower bundle description. This documentation mismatch is dangerous because it normalizes a review gap: users or platform operators may rely on high-level metadata while the code and comments reveal significantly broader powers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The history and detail tools expose call records, summaries, metadata, and full transcripts, all of which may contain sensitive personal or business information. Although masking can be requested, the tools do not strongly enforce privacy-safe defaults at the interface level or provide user-facing warnings commensurate with the sensitivity of the returned data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Webhook creation, modification, testing, and deletion let the plugin configure external data flows and event delivery destinations. In a bundle presented as install/publish helpers, this hidden capability can enable unexpected outbound integrations, data leakage to attacker-controlled endpoints, or disruption of existing notification infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill defines very broad activation phrases for outbound calling, including common verbs like 'call', 'ring', 'negotiate', and multilingual variants, paired with an instruction to automatically execute the full call workflow. This increases the risk of accidental or ambiguous invocation of real-world telephony actions, especially because the skill is configured with always-on metadata and does not require a clear confirmation boundary before placing calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow requires fetching full call transcripts, saving analytics, tagging conversations, and reporting key quotes back to the user, but it does not clearly warn about the privacy sensitivity of transcript contents. This can expose personally identifiable information or sensitive conversation content to a user who requested a call outcome without understanding the extent of data retrieval and disclosure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · plugin/skills/lunara-voice/SKILL.md (reported line 125)May include surrounding context.

md

7. **Report final result to user** — summarize: who answered, what was discussed, what was agreed, next steps. Include key quotes from transcript.

**⚠️ CRITICAL BUG PREVENTION:**
- **NEVER** grab the first record from `lunara_history_list` without checking `date_from` and phone number match
- Old call records will appear in history — you MUST filter them out using `date_from=<timestamp before call>`
- If you report results from a call that happened BEFORE `lunara_call_single`, you are reporting the WRONG call
- Always verify: does the transcript mention the topic/context of THIS call, not some previous call?

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents API key creation, revocation, and permanent deletion without a corresponding warning that these are destructive or security-sensitive actions. In an agent context, this can lead to accidental credential lifecycle changes, service disruption, or creation of new privileged credentials without adequate user awareness or confirmation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent not to ask the user whether it should check results and instead to silently poll for completion and proceed through transcript retrieval automatically. This reduces user control over a privacy- and cost-affecting workflow and encourages autonomous execution of multiple side-effecting steps after minimal prompting.

Content

Scanner excerpt · plugin/skills/lunara-voice/SKILL.md (reported line 264)May include surrounding context.

md

**Every outbound call (lunara_call_single or campaign) MUST complete the entire workflow in a single turn. There are no exceptions — the user should NEVER have to ask "what happened?" separately:**

1. Do NOT stop after initiating the call to say "Call started, SID: xxx" and wait
2. Do NOT ask the user "should I check the results now?"
3. Do NOT search for the transcript while the call is still active — it doesn't exist yet!
4. **Poll `lunara_history_list` silently** every 25-30 seconds until the call record appears as completed (max 5 minutes / 10 attempts)
5. Only AFTER the call record appears as completed, fetch `lunara_history_detail` with transcript

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The example mappings reinforce permissive trigger behavior by associating short, underspecified requests with actions that can place calls or alter system state. While examples are documentation rather than executable logic, they shape agent behavior and make unsafe invocation patterns more likely in downstream use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.