Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill coherently describes NoddyAI/Graine API use, including powerful telephony and account actions that require careful user confirmation.
Install only if you intend to let your agent use authorized NoddyAI/Graine API credentials. Confirm every call, batch, transfer, deletion, token change, and webhook change, and treat phone numbers, CSV uploads, transcripts, recordings, and webhook payloads as sensitive data subject to your consent, security, and retention obligations.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /api/v1/api-tokens/revoke-token/<TOKEN_TO_REVOKE>
Authorization: Bearer <API_KEY>
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /api/v1/agents/<AGENT_ID>?org_id=<ORG_ID>
Authorization: Bearer <API_KEY>
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer YOUR_gat_TOKEN" \
"https://api.graine.ai/api/v1/api-tokens/validate-token"
This markdown file describes a record option for outbound calls, which can affect user privacy and may have legal or consent implications. The endpoint reference does not include any warning or disclosure about recording behavior, data handling, or obtaining consent from call participants.
The webhook_url field sends completed-call payloads to a user-specified URL, which can expose call metadata or other sensitive information to external infrastructure. The documentation does not warn users that this behavior transmits potentially sensitive data off-platform.
The batch upload feature explicitly accepts CSV files containing phone numbers and names, which are personal data fields. The markdown reference provides no warning about handling, storage, or privacy implications of uploading contact lists.
The example payload sends customer-specific data via webhook_url and templated prompts without any notice about privacy, consent, data minimization, or secure handling. In a voice-agent/API integration context, this can normalize transmitting personal data to third-party endpoints and increase the risk of unintentional privacy violations or noncompliant deployments.
The outbound call example enables call recording with no accompanying guidance about consent, jurisdiction-specific recording laws, or secure storage of recordings. In telephony workflows, this omission can lead users to deploy recording by default in ways that violate privacy requirements or expose sensitive spoken data.
The batch calling example processes multiple names, phone numbers, and policy numbers without warning about bulk outreach compliance, opt-in requirements, or safe handling of personal contact data. Because this is operational example documentation, it may encourage large-scale processing of PII without safeguards, increasing privacy, spam, and regulatory risk.
The webhook examples include sensitive fields such as phone numbers, transcripts, recording URLs, and extracted data without any warning about privacy, retention, access control, or secure storage requirements. Consumers may log or expose this data insecurely, increasing the risk of PII leakage, unauthorized access to call content, and downstream compliance violations.
The documentation states that no-answer, voicemail, and busy are internal-only and not sent to the webhook, but then lists some of those values as valid status values without clearly scoping them as non-webhook/internal statuses. This inconsistency can cause integrators to build incorrect state handling, trust impossible webhook states, or fail open when unexpected payloads arrive, which is a security-relevant integrity issue in event-driven systems.
No suspicious patterns detected.