ClawHub
Back to skill

Security audit

Ringg Voice Agent

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Ringg voice-call integration, but it can place real calls, launch campaigns, and access transcripts without enough documented confirmation, consent, or webhook security safeguards.

Install only if you are prepared to add operational controls yourself: require explicit approval before every call or campaign, preview recipients and campaign size, confirm lawful consent and opt-out handling, restrict transcript/history access, use the least-privileged Ringg key available, and secure webhooks with HTTPS, signing-secret verification, replay checks, and a cleanup process.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger language is broad enough to activate on generic mentions of phone or voice-call activity, which increases the chance the skill is invoked in contexts the user did not explicitly intend. Because this skill can place real outbound calls and manage campaigns, accidental activation could lead to unwanted external actions, disclosure of contact data, or unintended call placement.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documents actions that initiate outbound calls and batch campaigns using real phone numbers and customer data, but it does not require any user-facing warning, consent check, or confirmation before contacting third parties. In a voice-calling context, that omission is risky because the skill can transmit personal data to an external provider and trigger real-world communications at scale, amplifying privacy, compliance, and abuse risks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The API reference enables outbound calls, campaign launches, transcript retrieval, analytics, and webhook delivery using personal contact data, but provides no warning or guidance around consent, lawful basis, opt-out handling, transcript sensitivity, or other privacy/compliance constraints. In a voice-calling skill, this omission can lead integrators to automate high-impact contact actions and process sensitive personal data without appropriate safeguards, increasing legal, privacy, and abuse risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.