ClawHub
Back to skill

Security audit

Agentphone Skills

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is purpose-aligned, but it needs Review because it enables live calls, SMS, billable account actions, and sensitive transcript handling while giving weak consent and credential-safety guidance.

Review this carefully before installing. Use it only with explicit permission for each person or business the agent contacts, expect phone numbers/messages/calls to incur costs, and assume SMS and call transcripts may contain sensitive personal data. Do not paste AgentPhone API keys into chat or store them in persistent agent memory; use an environment variable or a real secrets manager, rotate any key that was pasted into a conversation, and only configure webhooks to endpoints you control and trust.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
README.md:7
Finding

Unpinned Third-Party Package Is Downloaded and Executed During Installation

Content
View full analysis
Remediation
View remediation
`. - Publish and verify package integrity information, such as an npm lockfile or trusted checksum. - Document the expected npm registry and package publisher identity. - Review the installer and all package lifecycle scripts before recommending execution. - Where feasible, use an installation method that does not execute package lifecycle scripts. - Update releases through a controlled review process rather than implicitly accepting the latest package version. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:137
Finding

API Keys Are Recommended for Storage in Persistent Agent Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:98
Finding

Skill Instructions Solicit API Credentials and Verification Codes Through Chat

Content
View full analysis
**Already have an account?** If your human's email is already associated with an AgentPhone account, this call returns `409 Conflict`. Don't retry with a different email — tell your human something like: > > > "Looks like you already have an AgentPhone account under this email. Open [agentphone.to/dashboard](https://agentphone.to/dashboard), go to Settings → API Keys, generate a new key, and paste it back to me." ``` ```markdown ### Step 2: Ask Your Human for the Code Nothing has been provisioned yet — that happens on verify. Tell your human something like: > "I'm signing myself up for AgentPhone. I sent a verification email to your inbox with a 6-digit code — can you give it to me? Once I have it, I'll get my own phone number." ``` ```markdown **Save your `api_key` immediately.** Store it in an environment variable or your persistent memory. Never paste it into chat. The key is returned once. ``` ### Technical Analysis The Skill explicitly instructs an agent to ask the user to paste a newly generated API key into the conversation. It also requests a six-digit signup OTP through the same conversational channel. These instructions conflict with the later statement that the key must never be pasted into chat. Chat input commonly becomes part of conversation history and may be retained by the agent host, model provider, telemetry systems, logs, or transcript exports. Passing a bearer token through model context therefore expands the credential's exposure beyond the minimum required for authentication. The OTP request is part of the declared account-verification workflow, but accepting it in ordinary chat still exposes the code to the conversation channel. During its validity period, the OTP and associated ve ...[truncated 1503 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (46)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The autonomous outbound AI calling feature is documented as a simple callable action but omits safety guidance about consent, legal restrictions, and the risks of impersonation or real-time social engineering. Because the skill is specifically designed to let agents place real phone calls, the lack of warnings is more dangerous here than in a generic API reference.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 131)May include surrounding context.

md
### make_web_call

Create a browser-based web call. Returns an access token for the AgentPhone Web SDK. Token expires after 30 seconds.

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run npx skills.sh install agentphone without pinning a specific package version or integrity source. This creates a supply-chain risk because a later malicious or compromised package release could be fetched and executed at install time, and the command is presented as the primary setup path for a skill that enables external communications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises buying phone numbers, making calls, reading SMS, and setting webhooks, but does not warn about real-world charges, privacy exposure, consent requirements, or effects on external systems. In this skill's context, those omissions are significant because the described actions interact with real people, telecommunications infrastructure, and potentially sensitive message content, increasing the chance of accidental misuse or unauthorized data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is designed to let an agent contact real people by phone and SMS, but the introductory and main usage flow do not prominently require user consent, disclose transcript collection, or warn about privacy/compliance risks before encouraging use. In this context, autonomous real-world communications can create legal, privacy, and trust harms if the agent contacts people or captures conversations without explicit approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 404)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 420)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 429)May include surrounding context.

Step 1: Sign up

bash
curl -X POST https://api.agentphone.to/v0/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

Static analysis

No suspicious patterns detected.