Back to skill

Security audit

KallyAI Executive Assistant (Claude Code)

Security checks across malware telemetry and agentic risk

Overview

This looks like a real KallyAI CLI, but it gives an agent broad authority to trigger calls, emails, bookings, orders, subscription changes, and phone-routing changes with limited in-skill safety boundaries.

Install only if you are comfortable giving KallyAI broad delegated access over communications, bookings, spending-related tasks, phone numbers, routing, connected channels, and subscriptions. Before using the `ask` command, require explicit confirmation for recipients, message contents, calls, orders, bookings, cancellations, subscription changes, and phone-number or forwarding changes; review KallyAI privacy and retention terms; use it on trusted machines; and log out or revoke access when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill exposes powerful capabilities including shell, network, file read, and file write, but does not declare permissions or boundaries to constrain their use. In a skill that can make calls, send emails, manage bookings, and modify phone settings, this creates a significant transparency and least-privilege failure that can enable unintended or unauthorized actions.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The webhook channel connection endpoints explicitly ingest highly sensitive third-party credentials such as Telegram bot tokens and WhatsApp access tokens. In an agent skill context, this is dangerous because it normalizes collecting and transmitting external platform secrets through the skill, increasing the risk of credential exfiltration, overscoped access, or accidental logging/retention.

Vague Triggers

High
Confidence
95% confidence
Finding
The manifest uses extremely broad trigger phrases such as common words related to calls, booking, messages, research, calendar, food, and errands, making accidental invocation likely. Because the skill can initiate real-world actions affecting communications, purchases, accounts, and phone configuration, overbroad activation materially increases the risk of unintended execution.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The workflow frames the skill as appropriate for a wide range of loosely defined user intents and repeatedly recommends the generic ask command without clear exclusions. That broad routing model is dangerous here because the skill can autonomously choose actions across many domains, increasing the chance of overreach, unsafe delegation, or execution without sufficiently specific user authorization.

Missing User Warnings

High
Confidence
96% confidence
Finding
The description promotes autonomous handling of calls, email, bookings, bills, rides, food orders, errands, and phone number management without warning users that these actions can change accounts, send communications, spend money, expose personal data, or reconfigure telephony. In this context, the omission is especially dangerous because the skill is positioned as a general-purpose delegation agent with real external effects.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The command reference includes many destructive or privacy-sensitive operations such as transferring or taking over calls, importing contacts, provisioning or releasing phone numbers, sending email, changing subscriptions, ordering rides and food, and managing channels, but it provides no embedded safety guidance. Without warnings or confirmation expectations, users and invoking agents may treat these as routine read-only commands, increasing the risk of accidental account changes, data disclosure, unwanted outreach, or financial loss.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The bulk deletion endpoint for inbound call records is destructive and the reference provides no warning about confirmation requirements, recovery limits, or safeguards. In an AI assistant setting, ambiguous destructive operations increase the chance of unintended deletion from prompt ambiguity, misuse, or tool-parameter abuse.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Delete Inbound Calls

**`DELETE /v1/inbound/calls`**

Bulk delete inbound call records.
Confidence
87% confidence
Finding
DELETE /v1/inbound/calls`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Delete Routing Rule

**`DELETE /v1/inbound/rules/{rule_id}`**

---
Confidence
78% confidence
Finding
DELETE /v1/inbound/rules/{rule_id}`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Delete Contact

**`DELETE /v1/inbound/contacts/{contact_id}`**

---
Confidence
76% confidence
Finding
DELETE /v1/inbound/contacts/{contact_id}`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Remove Call Forwarding

**`DELETE /v1/phone-numbers/{phone_number_id}/forwarding`**

---
Confidence
72% confidence
Finding
DELETE /v1/phone-numbers/{phone_number_id}/forwarding`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Release Phone Number

**`DELETE /v1/phone-numbers/{phone_number_id}`**

Releases the phone number (cannot be undone).
Confidence
90% confidence
Finding
DELETE /v1/phone-numbers/{phone_number_id}`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Event

**`DELETE /v1/actions/calendar/events/{event_id}`**

---
Confidence
69% confidence
Finding
DELETE /v1/actions/calendar/events/{event_id}`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Cancel Booking

**`DELETE /v1/actions/bookings/{booking_id}`**

---
Confidence
71% confidence
Finding
DELETE /v1/actions/bookings/{booking_id}`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Disconnect Account

**`DELETE /v1/email/accounts/{account_id}`**

---
Confidence
74% confidence
Finding
DELETE /v1/email/accounts/{account_id}`**

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Delete Contact Email

**`DELETE /v1/channels/email/{email_id}`**

Remove a contact email address. Returns 204 on success.
Confidence
70% confidence
Finding
DELETE /v1/channels/email/{email_id}`**

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.