Gemini Live Phone

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:29 PM UTC
• Version: 1.0.1

Overview

The skill is a real Twilio-to-Gemini phone bridge, but it exposes internet-facing phone-call and live-audio capabilities without enough authentication, scoping, or safe deployment defaults.

Review this carefully before installing. Only run it behind strong authentication, Twilio signature validation, trusted-host enforcement, rate limits, destination and caller-ID allowlists, explicit PUBLIC_URL/TWILIO_ACCOUNT_SID/TWILIO_FROM configuration, and clear consent and privacy handling for live audio and any recording. Pin dependencies before deployment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bridge.py:523

Finding

Unauthenticated Outbound Call Creation Using Privileged Twilio Credentials

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bridge.py:502

Finding

Twilio WebSocket and Webhook Requests Are Accepted Without Origin Authentication

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge.py:487

Finding

Untrusted Host Header Controls Twilio Media Stream Destination

Content

View full analysis

""" return Response(content=twiml, media_type="application/xml") ``` ```python @router.api_route("/twiml", methods=["GET", "POST"]) async def twiml_for_outbound(request: Request): """TwiML for outbound calls — connects to the same WebSocket stream.""" twiml = f""" """ return Response(content=twiml, media_type="application/xml") ``` ### Technical Analysis Both TwiML-producing endpoints derive the WebSocket destination from the untrusted HTTP `Host` header. The value is interpolated directly into XML without an allowlist or XML escaping. In deployments where a reverse proxy forwards arbitrary Host headers, an attacker can influence the generated `` URL. Twilio follows this URL when setting up the media stream, so an attacker-controlled host can become the recipient of live call audio. The same interpolation can also produce malformed XML because metacharacters are not escaped. Whether a given injected host is accepted depends on the HTTP server, reverse proxy, and Twilio URL parsing, bu ...[truncated 1382 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge.py:119

Finding

Hardcoded Twilio Account, Telephone Number, and External Deployment Defaults

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Open-Ended and Unhashed Python Dependency Versions Permit Unreviewed Upgrades

Content

View full analysis

=0.135.0 uvicorn>=0.41.0 google-genai>=1.60.0 twilio>=9.0.0 audioop-lts>=0.2.0 websockets>=16.0 python-multipart>=0.0.20 ``` ### Technical Analysis Every dependency is specified using an open-ended minimum version. A future installation may therefore resolve to versions that did not exist when the Skill was reviewed. No hashes or lock file are supplied to verify the exact package artifacts. The dependencies are obtained from normal third-party package infrastructure and no typosquatted package was identified in the reviewed manifest. Nevertheless, the current specification makes builds non-reproducible and allows a compromised, malicious, or incompatible future release to be installed automatically. Because these libraries execute in the same process as Twilio and Gemini credentials, a compromised dependency would inherit access to environment variables, network connections, audio data, and filesystem permissions available to the bridge. ### Attack Path 1. A maintainer publishes a future package release, or a package-distribution account is compromised. 2. The malicious or vulnerable release remains compatible with the broad `>=` constraint. 3. A user performs a fresh installation or rebuild. 4. The package resolver selects the new unreviewed version. 5. Package installation or import-time code executes in the bridge environment. 6. The compromised dependency can access API credentials, telephony metadata, live audio, and network capabilities available to the process. ### Impact Assessment A successful dependency compromise could obtain all privileges held by the bridge process, including: - Access to Twilio and Gemini credentials present in environment variables or process memory. - Interception or manipulation of live cal ...[truncated 438 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose understates the actual behavior by focusing on a call bridge while also exposing outbound call initiation and webhook handling, and the finding indicates additional recording-related behavior and embedded Twilio identifiers not disclosed in the description. That mismatch is dangerous because users may deploy a skill capable of initiating real-world telecom actions and handling sensitive call metadata without informed consent or adequate review.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 74% confidence

Finding

The skill declares required environment variables and implies operational capabilities, but it does not declare an explicit tool/permission scope despite functionality that can place calls and expose networked endpoints. This weakens least-privilege review and can mislead operators about what the skill is allowed to do, especially because it bridges external communications and may write or generate runtime artifacts in practice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill bridges live phone audio through Twilio and Google Gemini, but the documentation does not warn about privacy, data sharing, retention, or disclosure obligations. Because the content is real-time voice from phone calls, missing privacy guidance is especially risky and may lead to unlawful processing of sensitive communications data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation provides a ready-to-run API example that places outbound calls to arbitrary phone numbers but does not warn that this triggers real telephony activity with possible cost, abuse, and consent implications. In this context, omission of such warnings increases the chance of accidental or unauthorized calls from a deployed system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Outbound Call API

bash

curl -X POST https://your-domain/gemini-live/call \
  -H 'Content-Type: application/json' \
  -d '{"to": "[phone]", "greeting": "Hello! This is Marcia."}'

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Tainted flow: 'path' from os.getenv (line 61, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/bridge.py (reported line 62)May include surrounding context.

python

if self._file:
                self._file.close()
            path = OPENCLAW_LOG_DIR / f"openclaw-{now_date}.log"
            self._file = open(path, "a", encoding="utf-8")
            self._current_date = now_date

    def emit(self, record: logging.LogRecord):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The bridge forwards live caller audio to the Gemini API for processing, but this file does not provide any caller disclosure, consent prompt, or gating before transmission begins. In a telephony context this can create privacy, compliance, and data-handling exposure, especially for jurisdictions or deployments requiring notice before AI processing or third-party sharing of call content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The outbound call endpoint allows recording to be enabled and then initiates Twilio recording without any user-facing disclosure or consent mechanism in the generated call flow. Recording phone calls without notice can violate legal requirements and materially increases privacy risk because sensitive voice content may be stored and retained.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally pull in newly introduced vulnerable or breaking releases in a network-facing FastAPI service.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

fastapi>=0.135.0
uvicorn>=0.41.0
google-genai>=1.60.0
twilio>=9.0.0

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

FastAPI has known advisories, and because the manifest does not pin an exact version, it is impossible to determine from this file whether an affected release will be installed. In a public-facing API service, that uncertainty is a real dependency-risk finding even if the currently resolved version might be safe.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using an unpinned uvicorn version permits uncontrolled dependency drift across deployments. For an internet-exposed ASGI server, this can lead to inconsistent security posture and accidental adoption of vulnerable releases.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

fastapi>=0.135.0
uvicorn>=0.41.0
google-genai>=1.60.0
twilio>=9.0.0
audioop-lts>=0.2.0

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

uvicorn has historical security advisories, but the unpinned requirement prevents verifying whether deployments resolve to a patched version. Since uvicorn is the HTTP/WebSocket server, this ambiguity matters more than it would for a non-network-exposed library.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The Google GenAI client is not pinned, so installations may fetch different versions over time. While not proof of an active exploit, this creates supply-chain and stability risk for a real-time voice integration that depends on predictable library behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

fastapi>=0.135.0
uvicorn>=0.41.0
google-genai>=1.60.0
twilio>=9.0.0
audioop-lts>=0.2.0
websockets>=16.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The Twilio SDK is specified as a minimum version only, allowing later versions to be installed without review. In a telephony bridge handling live calls, unreviewed dependency changes can affect security-sensitive request handling and authentication flows.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

fastapi>=0.135.0
uvicorn>=0.41.0
google-genai>=1.60.0
twilio>=9.0.0
audioop-lts>=0.2.0
websockets>=16.0
python-multipart>=0.0.20

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The audio processing library is unpinned, so builds are not reproducible and may pull unexpected future releases. This is a supply-chain hygiene issue rather than direct evidence of compromise, but still increases operational risk.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

uvicorn>=0.41.0
google-genai>=1.60.0
twilio>=9.0.0
audioop-lts>=0.2.0
websockets>=16.0
python-multipart>=0.0.20

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The websockets package is unpinned, which allows dependency drift and makes it hard to know whether deployments include a safe version. Because this skill bridges live audio over WebSockets, predictable and patched dependency versions are especially important.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

google-genai>=1.60.0
twilio>=9.0.0
audioop-lts>=0.2.0
websockets>=16.0
python-multipart>=0.0.20

Unverifiable Dependency: websockets has 4 known advisory(ies) (CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

websockets has known DoS-related advisories, and the requirement is not pinned, so the deployed version cannot be verified from the manifest. Given this skill's heavy reliance on persistent real-time WebSocket sessions, unresolved version ambiguity increases exposure to availability issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

python-multipart is unpinned despite being a package with a history of parser-related advisories. In a FastAPI app, leaving it unconstrained makes it difficult to verify whether deployments are protected from multipart parsing flaws and DoS issues.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

twilio>=9.0.0
audioop-lts>=0.2.0
websockets>=16.0
python-multipart>=0.0.20

Unverifiable Dependency: python-multipart has 16 known advisory(ies) (CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-53539 (python-multipart: Quadratic-time querystring parsing with semicolon separators c) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

python-multipart has numerous parser and DoS advisories, and the dependency is unpinned, so there is meaningful uncertainty about whether a vulnerable version may be installed. In a web service context, multipart parser flaws can be exploited remotely to degrade availability or trigger excessive resource consumption.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/bridge.py (reported line 699)May include surrounding context.

python

config.echo_decay_ms = args.echo_decay_ms
    
    logging.basicConfig(
        level=getattr(logging, config.log_level.upper()),
        format="%(asctime)s [%(name)s] %(levelname)s: %(message)s",
    )