Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

easy phone call

v1.0.2

Launch human-like outbound calls with a single command after confirming call details; supports business leads, reservations, reminders, and surveys.

0· 73·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for naive-white-expert/easy-phone-call.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "easy phone call" (naive-white-expert/easy-phone-call) from ClawHub.
Skill page: https://clawhub.ai/naive-white-expert/easy-phone-call
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install easy-phone-call

ClawHub CLI

Package manager switcher

npx clawhub@latest install easy-phone-call
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code and SKILL.md implement an outbound-call integration that requires an OUTBOUND_API_KEY and the 'uv' runner, which is coherent with the described purpose. However the registry metadata at the top of the submission lists no required env vars or binaries, which conflicts with SKILL.md and the scripts. That mismatch is unexplained and worth verifying with the publisher.
!
Instruction Scope
Runtime instructions and the included scripts collect phone numbers and conversation context and send them to https://www.skill.black (Outbound AI). The SKILL.md mandates showing a confirmation card and obtaining explicit user consent before calling; that is a good control, but the Python scripts themselves perform the call when invoked and do not enforce confirmation. The skill also writes PII-containing JSONL files (memory/skills/requests.jsonl and costs.jsonl) to disk. Sending PII to a third-party service and persisting it locally are expected for this functionality but carry privacy/risk implications that must be accepted intentionally.
Install Mechanism
There is no remote install or download step—this is an instruction+script bundle included in the skill. No external archives or package installs are performed by an installer spec, minimizing supply-chain risk.
Credentials
The skill requires a single service credential (OUTBOUND_API_KEY) and optionally OUTBOUND_BASE_URL, which are proportionate to an API-backed calling service. Again, the registry metadata incorrectly states 'none' for required env vars while SKILL.md and the scripts require the API key—this inconsistency should be resolved before trusting the skill.
Persistence & Privilege
The skill does not request 'always: true' and is user-invocable only. It writes logs and history under its own memory directory (memory/skills) and a user-local config (~/.openclaw/secrets/outbound.json) if used; it does not modify other skills or system-wide configs.
What to consider before installing
This skill will send phone numbers and full conversation context to https://www.skill.black and stores call/request logs locally. Before installing: 1) Confirm you trust the domain and review its privacy policy and terms; 2) Verify the registry metadata discrepancy (manifest says no env vars but SKILL.md and scripts require OUTBOUND_API_KEY and 'uv'); 3) Only provide an API key scoped to this service, and consider using a dedicated key that can be revoked; 4) Ensure your deployment/policy requires the agent to present and record explicit user consent before invoking the make-call script (the code does not enforce consent itself); 5) If you need stronger privacy, audit or modify the scripts to avoid persisting PII or to route through a vetted gateway. If you cannot verify the publisher or domain, treat this skill as higher risk and do not provide sensitive credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fj1npwhqrtczpm7w8ap8mh984wpf2
73downloads
0stars
3versions
Updated 1w ago
v1.0.2
MIT-0

Outbound AI Call - 智能外呼服务

用户有打电话意图 → 意图提取 → 信息收集 → 确认 → 调用外呼 → 检查结果 → 补充信息(如需)


⚠️ 隐私声明与用户确认

重要:在调用外呼接口前,必须向用户展示确认卡片并获得明确同意。

数据收集与传输

本 skill 会收集以下信息并发送到 Outbound AI 外呼服务:

数据类型用途是否传输是否本地存储
电话号码外呼目标号码
对话上下文AI 理解通话目的
通话记录状态和日志-

第三方服务

本地数据保留

  • 请求记录:memory/skills/requests.jsonl
  • 通话日志:memory/skills/costs.jsonl
  • 这两个文件包含 PII(电话号码、对话内容),用户可随时删除

用户确认流程

在信息收集完毕后,必须展示确认卡片:

📞 外呼确认

对象:{Who} 电话:{Phone} 目的:{What}

⚠️ 以下信息将发送到 Outbound AI 外呼服务: • 电话号码:{Phone} • 对话内容:{对话摘要}

确认拨打?(回复"确认"或"取消")

仅在用户明确确认后才执行外呼。


🎯 触发条件

当用户表达以下意图时触发:

"帮我给xxx打个电话预约个位子" "帮我问下我父亲最近身体怎么样" "给客户打电话确认预约时间"

关键词:打电话、致电、外呼、电话通知、电话确认


📋 步骤 1:意图提取

从用户输入中提取核心信息:

要素说明示例
Who打给谁(名称/关系/机构)蜀九香、客户、餐厅
Phone电话号码18033009923
What外呼目的预约位子、活动、确认时间

📝 步骤 2:信息收集

目标:一次收集尽可能多的信息,减少后续追问次数。

重要:本 skill 采用通用信息框架 + 后端动态追问模式。后端会根据外呼目的自动判断需要收集的信息,并在缺少参数时返回追问要求。

信息收集清单

基础信息(必问)

信息项说明追问方式
Who被叫方名称/关系"请问打给谁?"
Phone电话号码"请问对方电话是多少?"
What外呼目的"请问打电话主要想说什么?"

时间信息(涉及时间时追问)

信息项适用场景追问方式
When预约、提醒、限时活动"请问是什么时间?"
Deadline限时事项"有截止时间吗?"

信息收集策略

按场景智能追问

预约类(预约位子、预约安装、预约服务)

已了解:{Who},{What} 追问:

  1. 请问预约什么时间?
  2. 请问预约在哪个地点?(如不明确)
  3. 请问几个人/需要什么服务?
  4. 有什么特殊要求吗?

活动类(活动通知、产品推广)

已了解:{Who},{What} 追问:

  1. 请问是什么产品/活动?
  2. 有什么核心卖点或优惠吗?
  3. 活动时间是多久?

✅ 步骤 3:信息确认(必须)

⚠️ 重要:在调用外呼接口前,必须向用户展示确认卡片并获得明确同意。

收集完毕后,展示确认卡片:

📞 外呼确认

对象:{Who}({ContactName}) 电话:{Phone} 目的:{What}

详细信息: • 时间:{When} • 地点:{Where} • 具体事项:{Details}

⚠️ 以下信息将发送到 Outbound AI 外呼服务: • 电话号码:{Phone} • 对话内容:{对话摘要}

确认拨打?(回复"确认"或"取消")

用户确认后才可进入下一步。如果用户取消,则终止流程。


🚀 步骤 4:调用外呼接口

构建请求参数

参数类型必填说明示例值
phonestring外呼目标电话号码"18033009923"
messagesstring[]对话上下文["用户: ...", "助手: ..."]
mustOutboundboolean-缺少选填参数时是否强制外呼false

mustOutbound 使用场景

  • 用户明确要求立即外呼,即使信息不完整
  • 例如:用户说"不用问了,直接打吧"

messages 说明

  • 包含用户与助手之间的完整对话上下文
  • 后端根据上下文生成 prompt
  • 格式为字符串数组:"角色: 内容"

执行调用

推荐:Python 脚本(跨平台)

执行命令:

uv run scripts/make-call.py --phone "{电话}" --messages '["用户: ...", "助手: ...", "用户: ..."]'

强制外呼

uv run scripts/make-call.py --phone "{电话}" --messages '["用户: ..."]' --must-outbound


🔄 步骤 5:处理返回结果

返回格式

成功响应示例

字段说明
code"10000"成功状态码
result"成功"结果描述
data"12331@e561a439..."request_id

失败响应示例

字段说明
code"190001"风控拦截
result"风控校验不通过..."拦截原因

code 说明

code说明处理方式
10000成功告知用户,返回 request_id
190001风控拦截不再重试,告知用户风控原因
其他失败根据 result 提示用户

📊 步骤 6:查询通话结果

外呼发起后,可查询通话结果:

执行命令:

uv run scripts/query-call.py --request-id "{request_id}"

查询参数说明

参数必填说明
--request-id外呼返回的 request_id
--no-retry-禁用自动重试,只查询一次

重试机制

配置默认值说明
首次等待30 秒外呼完成后才能查询到结果
重试间隔20 秒未完成时的重试间隔
最大重试12 次总等待时间约 4.5 分钟

🚀 快速开始(首次使用引导)

当检测到用户首次使用(未配置 API Key)时,按以下话术引导:

你好!我是你的智能通话助手,很高兴能为你服务。😊

从现在起,那些琐碎的预约、重复的通知,或者偶尔不便亲自开口的询问,都可以放心地交给我。我会像真人助理一样,带着温度与对方沟通,并把最终结果整理成简报带回给你。

但在我们开始第一次合作前,需要请你完成一个小小的「授权」:

🔑 请前往 Outbound API 中心 申请您的专属 API Key,然后告诉我即可。

配置完成后,你就可以随时吩咐我,例如: 📞 "帮我给蜀九香打个电话,预订今晚 7 点 4 个人的位子" 📞 "给老爸打个电话问候一下,确认他明天的体检时间"


⚙️ 配置

前置要求

本 skill 需要以下工具:

  • uv - Python 运行器(ClawX 自带,跨平台)

环境变量(必需)

变量名必需说明默认值
OUTBOUND_API_KEYAPI 密钥(申请地址见下方)-
OUTBOUND_BASE_URL-API 地址https://www.skill.black

配置方式

推荐:环境变量(更安全)

添加到 ~/.zshrc~/.bashrc

export OUTBOUND_API_KEY="your-api-key"

可选:自定义 API 地址

export OUTBOUND_BASE_URL="https://www.skill.black"

备选:配置文件

创建配置目录:

mkdir -p ~/.openclaw/secrets

创建配置文件(注意设置权限):

chmod 600 ~/.openclaw/secrets/outbound.json


🔒 数据安全建议

凭据安全

  1. 优先使用环境变量:避免将 API Key 存储在文件中
  2. 文件权限:如果使用配置文件,务必设置 chmod 600
  3. 不要提交到代码仓库:将 outbound.json 添加到 .gitignore

本地日志

以下文件包含 PII(电话号码、对话内容):

  • memory/skills/requests.jsonl - 外呼请求记录
  • memory/skills/costs.jsonl - 通话日志

用户可随时删除这些文件以清除历史记录。

Comments

Loading comments...