ClawCall
v1.0.8Make real AI-powered phone calls. Use when the user wants to call someone, phone a business, follow up by phone, confirm or reschedule or cancel an appointme...
⭐ 4· 1.2k·1 current·1 all-time
byShrey Jindal@shreyjindal81
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (AI-powered phone calls for US/Canada) match the declared network permission (api.clawcall.dev) and the runtime instructions (POST /call, polling, call transcript/recording). No unrelated credentials, packages, or system access are requested.
Instruction Scope
SKILL.md stays on-topic (gather call details, construct a task, call via the API, poll for status, persist the API key, return transcript/recording). Two points to note: (1) it instructs the agent to persist the auto-provisioned API key and to read/write ~/.config/clawcall/key.json (declared in the header), which is necessary for session continuity but is sensitive; (2) it handles recordings/transcripts and recommends informing users about recordings — the guidance is present but you should ensure informed consent and verify any legal/regulatory requirements for recording calls in your jurisdiction.
Install Mechanism
This is instruction-only with no install spec and no code files, so nothing is written to disk beyond the explicit config file the skill asks to manage. That is lower risk compared to skills that download or install binaries.
Credentials
No environment variables or external credentials are required up front. The only requested persistent state is the API key saved to ~/.config/clawcall/key.json (declared). Persisting a session key in a plaintext file is proportionate to the service but is a privacy/secret-storage concern — SKILL.md itself recommends using a secure secret store if available.
Persistence & Privilege
The skill is not always-on and does not request elevated platform privileges. Autonomous invocation is allowed (platform default); that is expected for an agent-invokable skill that makes outgoing calls, but you may wish to consider agent autonomy policies if you don't want the agent to place calls without explicit user confirmation.
Assessment
This skill appears to do what it says, but before installing consider: 1) Privacy/consent — calls are recorded and transcripts/recordings are returned; confirm you have user consent and understand retention (SKILL.md says recordings live ~10 minutes). 2) Local storage of the API key — it's saved to ~/.config/clawcall/key.json by default; prefer a secure secret store if available and remove the file if you stop using the skill. 3) Live handoff/bridge numbers — supplying a bridge number will connect a real phone into the call, so only provide numbers you control. 4) Autonomous calls — the agent can be invoked; if you want to prevent unintended calls, restrict agent autonomy or require explicit confirmation before placing calls. 5) Verify the service (https://api.clawcall.dev / homepage) and its privacy/terms if you plan to put sensitive personal or financial information into calls. If any of the above is unacceptable, do not enable the skill or request modifications (e.g., avoid persisting keys, require explicit user confirmation before dialing).Like a lobster shell, security has layers — review code before you run it.
deepgramvk97abxxyaj4vkc5638apbhsw2h814eradtmfvk97abxxyaj4vkc5638apbhsw2h814eralatestvk974y36qq3j0wwwm753f23vcb18437zrphonevk97abxxyaj4vkc5638apbhsw2h814eratelnyxvk97abxxyaj4vkc5638apbhsw2h814eravoicevk97abxxyaj4vkc5638apbhsw2h814era
License
MIT-0
Free to use, modify, and redistribute. No attribution required.