Call My Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.1.3

Overview

The skill is transparent about its goal, but it asks users to install and run a referenced package that was not included in the reviewed artifact or pinned immutably.

Install only if you are comfortable approving local code execution from @mrbese/call-my-agent. Before proceeding, check the exact package version or commit, review the setup scripts, avoid administrative privileges, and confirm any Tailscale or persistence changes only when you understand the exposure and uninstall path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27
• Finding: Unpinned Third-Party Package and Installation Script Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 27-44 and 96-105 **Vulnerability Type**: Supply-chain exposure through unverified third-party package execution **Risk Level**: Medium ### Evidence `SKILL.md`, lines 27-44: ```markdown ## Source - ClawHub code package: `@mrbese/call-my-agent` - Public app repository: `https://github.com/mrbese/call-my-agent` - V1 runtime: OpenClaw only. - Roadmap only: Hermes, custom command adapters, Codex, and ChatGPT App. Prefer installing and running from the ClawHub code package. Keep GitHub as the public source and provenance link, not the normal install path. ## Security Review Notes This skill describes setup for a local voice app. It must treat the following actions as explicit user-confirmation gates: - Installing or updating the ClawHub package. - Cloning, downloading, or updating the external app repository. - Running `npm install` or any package install command. ``` `SKILL.md`, lines 96-105: ```markdown 3. **Prepare the packaged app.** - Prefer the ClawHub-installed package root for `@mrbese/call-my-agent`. - Ask for confirmation before installing or updating the package. - Ask for confirmation before running `npm install`. - Run `npm run setup:openclaw` to generate `.env.local`, preserve existing local values, create a local incoming-call token, and inspect OpenClaw auth without printing secrets. - Use `npm run setup:openclaw -- --install` only when dependency install was explicitly approved. - Keep generated local state out of publishable artifacts. ``` ### Technical Analysis The skill directs the agent to install and execute the external ClawHub package `@mrbese/call-my-agent`, including npm dependency installation and the package-defined `setup:openclaw` script. However, the audited project contains only `SKILL.md`; it does not include the referenced package source, dependency manifest, l ...[truncated 2543 chars]
• Remediation: ## Remediation Suggestions 1. Require an exact, immutable ClawHub package version rather than merely preferring a pinned version. 2. Publish and verify a cryptographic integrity digest or signed provenance record before installation. 3. Include the dependency manifest, lockfile, setup scripts, and service templates in the reviewable artifact. 4. Require lockfile-based installation, such as `npm ci`, and reject unexpected lockfile changes. 5. Initially install dependencies with lifecycle scripts disabled where operationally possible, then separately review and approve any required scripts. 6. Display the exact package version, resolved source, integrity value, and scripts that will execute before requesting confirmation. 7. Audit `setup:openclaw` and all transitive dependencies before allowing access to OpenClaw authentication files. 8. Run package setup with restricted filesystem permissions, minimal environment variables, and no administrative privileges. 9. Prevent setup scripts from receiving unnecessary secrets and verify that logs cannot expose authentication material or generated call tokens. 10. Pin GitHub fallback installations to a reviewed commit hash rather than a mutable branch or tag.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

- Start the app bound to `127.0.0.1` by default.
   - If the user requests another bind host, explain the exposure risk and ask
     for confirmation before changing it.
   - Offer, but do not silently install, `deploy/macos/ai.openclaw.call-my-agent.plist`.
   - Offer, but do not silently install, `deploy/linux/call-my-agent.service`.
   - Ask for confirmation before writing or enabling any persistence file.
   - Provide the clean stop/uninstall path before or immediately after enabling

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.