Security audit
Security checks across malware telemetry and agentic risk
This is a real Telnyx voice assistant, but it exposes a persistent phone-accessible service that can run local tools, search files, change reminders, and send messages with limited safeguards.
Install only if you intentionally want a persistent, phone-accessible assistant with local tool authority. Before use, restrict who can call, add webhook validation and a caller PIN or allowlist, disable or gate send_message and reminder deletion, fix shell execution to use argument arrays, use a scoped Telnyx key, limit WORKSPACE_DIR to non-sensitive files, and review or remove local gateway token access and automatic tunnel/app setup.
```bash cd /path/to/sip-voice-call-control nohup npm run start > sip-voice-call-control.log 2>&1 & ``` Or from an agent:
Or from an agent:
```typescript
// Use nohup to keep process alive after session ends
exec({
command: "cd /path/to/sip-voice-call-control && nohup npm run start > sip-voice-call-control.log 2>&1 &",
background: true```typescript
// Use nohup to keep process alive after session ends
exec({
command: "cd /path/to/sip-voice-call-control && nohup npm run start > sip-voice-call-control.log 2>&1 &",
background: true
})
```64/64 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access