ClawHub
Back to skill

Security audit

speko-calls

Security checks for vulnerabilities and agentic risk

Overview

This skill can place real paid phone calls, but it clearly discloses that power and requires per-call user confirmation and a platform API key.

Install only in an environment where paid outbound calling is approved and audited. Keep the platform API key in the environment, confirm every number and call purpose carefully, and remember that call reports may contain phone numbers and transcripts.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.