Voxrn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Voxrn telephony integration, but it grants real-world calling and texting authority and routes a bearer token to a configurable endpoint without enough guardrails or disclosure.

Review this before installing if your Voxrn key can place calls, send SMS, access transcripts, or modify contacts. Use OpenClaw secrets for the API key, keep VOXRN_BASE_URL unset or pinned to the trusted Voxrn HTTPS origin, and require explicit user confirmation before calls, texts, call termination, or sending sensitive message content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: mcp.json:6

Finding

Configurable MCP Endpoint Can Receive the Voxrn API Bearer Token

Content

View full analysis

Vulnerability Details

File Location: mcp.json, lines 6–9
Vulnerability Type: Credential exposure through an unrestricted configurable service endpoint
Risk Level: Medium

Vulnerable Code

json

"url": "${VOXRN_BASE_URL:-https://voxrn.com}/api/mcp",
"headers": {
  "Authorization": "Bearer ${VOXRN_API_KEY}"
},

Technical Analysis

The MCP server origin is derived from the VOXRN_BASE_URL environment variable, while the VOXRN_API_KEY is unconditionally attached as a bearer token. The configuration does not constrain the endpoint to the trusted Voxrn origin or require HTTPS.

Consequently, an attacker who can influence the process environment or deployment configuration can set VOXRN_BASE_URL to an attacker-controlled server. When OpenClaw communicates with that server, it sends the Voxrn bearer credential in the Authorization header.

This is a credential-routing weakness rather than a hardcoded-secret issue. Exploitation requires the ability to alter the relevant environment or configuration, but such influence may arise from a compromised shell profile, deployment manifest, service configuration, or copied setup instructions.

Attack Path

1. The victim configures a valid VOXRN_API_KEY.
2. An attacker or compromised deployment component sets VOXRN_BASE_URL to an attacker-controlled endpoint, such as https://attacker.example.
3. OpenClaw resolves the MCP URL as https://attacker.example/api/mcp.
4. OpenClaw sends a request containing:

   http

   Authorization: Bearer <VOXRN_API_KEY>
   

5. The attacker-controlled endpoint records the credential.
6. The attacker reuses the credential against the legitimate Voxrn service, subject to the permissions assigned to the key.

If a plaintext HTTP endpoint is accepted by the MCP client, network observers may also be able to intercept the bearer token in transit.

Impact Assessment

Compromise of the API key may allow unauthorized use of the Voxrn workspace wi ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the production MCP endpoint to the trusted service origin:

   json

   "url": "https://voxrn.com/api/mcp"
   

2. If custom endpoints are necessary, validate VOXRN_BASE_URL before registration:

   • Require HTTPS.
   • Permit only explicitly allowlisted hostnames.
   • Reject URLs containing user information or unexpected ports.
   • Normalize and validate the final origin before attaching credentials.

3. Do not forward the authorization header across cross-origin redirects. Reject redirects to any origin other than the validated original endpoint.

4. Use separate, least-privilege credentials for development, staging, and production endpoints. Never reuse a production Voxrn key with an arbitrary custom server.

5. Ensure environment variables and OpenClaw service configuration can be modified only by trusted administrators.

6. Add installation-time validation that fails closed when the endpoint is untrusted, malformed, or uses plaintext HTTP.

7. Rotate the Voxrn API key immediately if it may have been used while VOXRN_BASE_URL pointed to an untrusted endpoint, and review workspace audit and billing records for unauthorized activity.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

openclaw config secrets set voxrn_api_key vxk_...

text

The skill's `mcp.json` reads `${VOXRN_API_KEY}` at MCP-registration time so the secret never reaches the agent's prompt window.

## Conventions the agent should follow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README presents natural-language examples that can trigger outbound phone calls and SMS without any accompanying warning that these actions contact real third parties, may incur charges, and can have legal or operational consequences. In an agent-skill context, documentation strongly shapes user expectations and integration behavior, so omission of safety guidance increases the risk of accidental or insufficiently authorized real-world actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs sending SMS through Voxrn but does not clearly disclose that recipient phone numbers and message bodies are transmitted to a third-party external service. This creates a privacy and data-handling risk, especially if users send sensitive content under the assumption it remains within the local chat environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.