AgentCall

Give your agent real phone numbers for SMS, OTP verification, and voice calls via the AgentCall API.

Security Scan

The skill's instructions describe a legitimate telephony API and only require an API key, but the package metadata omits that required credential and there are webhook/billing risks users should be aware of.

Purpose & Capability

Name/description match the instructions: the skill is a thin instruction-only adapter for the AgentCall telephony API (provision numbers, SMS, calls, AI voice). That purpose would legitimately require an API key and network access, which the SKILL.md documents. However, the registry metadata incorrectly lists no required environment variables or primary credential — an inconsistency.

Instruction Scope

SKILL.md limits actions to HTTP calls to https://api.agentcall.co and describes endpoints for numbers, SMS, calls, transcripts, webhooks, and billing. It does not instruct reading unrelated files or secrets. Note: registering webhooks can cause inbound SMS/OTP content to be POSTed to arbitrary URLs, which is expected for webhooks but a sensitive action (may expose OTPs).

Install Mechanism

Instruction-only skill with no install spec or code files. Lowest-risk install posture; nothing is written to disk by the skill itself.

Credentials

SKILL.md explicitly requires AGENTCALL_API_KEY in the environment for Authorization. The skill metadata (requires.env and primary credential) lists no required env vars or primary credential — this mismatch is concerning because an API key is sensitive and should be declared. Aside from that, the single API key is proportionate to the service's functionality.

Persistence & Privilege

Skill is not always:true, does not request persistent system-level changes, and has no install hooks. Autonomous invocation is permitted by default (not flagged alone).

What to consider before installing

This skill appears to be a simple instruction document for the AgentCall telephony API and is mostly coherent, but before installing you should: 1) Confirm the publisher and domain (api.agentcall.co) and that you trust the service — the source is listed as unknown. 2) Be aware it requires an API key (AGENTCALL_API_KEY) — the registry metadata failing to declare that is an oversight and you should only provide a scoped key with minimal privileges. 3) Understand billing and abuse risk: provisioning numbers, sending SMS, and AI voice calls incur real costs and could be abused to send messages or make calls. 4) Treat webhooks as sensitive: if you register a webhook, inbound SMS/OTP data may be posted to that URL — don't point webhooks at public, unauthenticated endpoints unless you control them. 5) Prefer using this skill only with test/staging accounts and test phone numbers when validating OTP flows. If you need higher assurance, ask the publisher to fix the metadata to declare AGENTCALL_API_KEY as the primary credential and provide a verified homepage or source repository.

AgentCall — Phone Numbers for AI Agents

You have access to the AgentCall API for phone numbers, SMS, voice calls, and AI voice calls.

Authentication

All requests require: Authorization: Bearer <AGENTCALL_API_KEY>

The API key is available in the AGENTCALL_API_KEY environment variable.

Base URL

https://api.agentcall.co

For a complete plain-text API reference: GET https://api.agentcall.co/llms.txt

Phone Numbers

Provision a number:

POST /v1/numbers/provision
Body: { "type": "local", "country": "US", "label": "my-agent" }
Types: local ($2/mo), tollfree ($4/mo), mobile ($3/mo), sim ($8/mo, Pro only)
Response: { "id": "num_xxx", "number": "[phone]", "type": "local", ... }

List numbers:

GET /v1/numbers
Query: ?limit=20&country=US&type=local

Get number details:

GET /v1/numbers/:id

Release a number (irreversible):

DELETE /v1/numbers/:id

SMS

Send SMS:

POST /v1/sms/send
Body: { "from": "num_xxx", "to": "[phone]", "body": "Hello!" }
"from" can be a number ID or E.164 phone string

Get inbox:

GET /v1/sms/inbox/:numberId
Query: ?limit=20&otpOnly=true

Get a specific message:

GET /v1/sms/:messageId

Wait for OTP code (long-polls up to 60 seconds):

GET /v1/sms/otp/:numberId
Query: ?timeout=60000
Response: { "otp": "482913", "message": { ... } }

Voice Calls

Start an outbound call:

POST /v1/calls/initiate
Body: { "from": "num_xxx", "to": "[phone]", "record": false }

Start an AI voice call (Pro plan, $0.20/min): The AI handles the entire conversation autonomously based on your systemPrompt.

POST /v1/calls/ai
Body: {
  "from": "num_xxx",
  "to": "[phone]",
  "systemPrompt": "You are calling to schedule a dentist appointment for Tuesday afternoon.",
  "voice": "alloy",
  "firstMessage": "Hi, I'd like to schedule an appointment please.",
  "maxDurationSecs": 600
}
Voices (pick based on user's desired tone):
- alloy: neutral, balanced (default)
- ash: warm, conversational
- ballad: expressive, melodic
- coral: clear, professional
- echo: resonant, deep
- sage: calm, authoritative, confident
- shimmer: bright, energetic
- verse: smooth, articulate

List call history:

GET /v1/calls
Query: ?limit=20

Get call details:

GET /v1/calls/:callId

Get AI call transcript:

GET /v1/calls/:callId/transcript
Response: { "entries": [{ "role": "assistant", "text": "...", "timestamp": "..." }], "summary": "..." }

Hang up an active call:

POST /v1/calls/:callId/hangup

Webhooks

Register a webhook:

POST /v1/webhooks
Body: { "url": "https://example.com/hook", "events": ["sms.inbound", "sms.otp", "call.status"] }
Events: sms.inbound, sms.otp, call.inbound, call.ringing, call.status, call.recording, number.released

List webhooks:

GET /v1/webhooks

Rotate webhook secret:

POST /v1/webhooks/:id/rotate

Delete a webhook:

DELETE /v1/webhooks/:id

Usage & Billing

Get usage breakdown:

GET /v1/usage
Query: ?period=2026-02

Phone Number Format

All phone numbers must be E.164: +{country code}{number}, e.g. [phone]

Common Workflows

Test your app's SMS verification (QA)

1. POST /v1/numbers/provision with { "type": "local" } — get a test number
2. Enter the number into your staging app's verification form
3. GET /v1/sms/otp/:numberId?timeout=60000 — wait for the verification code
4. Assert the code arrives and your app accepts it
5. DELETE /v1/numbers/:id — release the test number

AI voice call

1. POST /v1/numbers/provision with { "type": "local" } — get a number (if you don't have one)
2. POST /v1/calls/ai with { "from": "num_xxx", "to": "+1...", "systemPrompt": "..." } — start the call
3. Wait for the call to complete
4. GET /v1/calls/:callId/transcript — get the full conversation transcript

Error Codes

• 401: Invalid or missing API key
• 403 plan_limit: Plan limit reached (upgrade to Pro at agentcall.co/dashboard)
• 404: Resource not found
• 422: Validation error (check request body)
• 429: Rate limit exceeded (100 req/min)