phone call agent

• Risk level: Low
• Analyzed: Apr 15, 2026, 1:04 PM
• Findings: 0
• Version: 1.0.5

Overview

The skill does what it says: it collects call info (after user confirmation) and posts conversation context to an outbound-call API using a single API key; requested binaries and env vars match the described functionality.

This skill is internally consistent with its stated purpose, but review these before installing: 1) Verify the provider (https://www.skill.black) and its privacy policy before giving an API key — all conversation context and phone numbers are sent to that service. 2) Ensure the skill only runs after explicit user confirmation as required by SKILL.md; the included scripts support a force flag (--must-outbound) that can bypass completeness checks — do not allow automatic or unconfirmed use. 3) The skill stores PII locally in memory/skills/requests.jsonl and costs.jsonl — delete those files or secure them (chmod 600) if you need to retain privacy. 4) Prefer environment variables for the API key rather than a file; if you use ~/.openclaw/secrets/outbound.json set strict permissions. 5) Small metadata mismatches appear (file _meta.json and SKILL.md versions differ from registry metadata); this is not a functional problem but you may want to confirm you have the intended release. 6) If you have any doubt about the external service, inspect or run the scripts in a sandbox or review network traffic before providing real phone numbers or sensitive conversation content.