Security audit
Security checks for vulnerabilities and agentic risk
This skill can place real phone calls through an external service, and its activation wording and safeguards are too broad for that level of impact.
Review this before installing if you do not want an agent to make real outbound calls. Only use it for explicit phone-call tasks, avoid sensitive medical, financial, account, or confidential business details unless you trust the service, and do not print or commit the stored API key or phone-number config.
An overly broad and domain-mismatched activation description increases the chance that the agent invokes a skill that can place real phone calls during normal coding or deployment assistance. In this skill context, that is especially dangerous because invocation can trigger external communications, charges, recordings, and transmission of personal or sensitive data.
The skill’s declared use context says it should be used for code generation, debugging, and deployment, while the actual capability is placing phone calls and handling recordings/transcripts. This mismatch can cause unintended activation in unrelated workflows, leading to external calls, disclosure of user data to a telephony service, and side effects the user did not expect.
The skill stores API keys and phone numbers locally and sends conversation content to an external call service, but the introductory guidance does not clearly warn users about persistence, external transmission, and call recording. Without prominent warnings, users may disclose sensitive personal, medical, financial, or business information without informed consent.
The hardcoded external endpoint shows that the skill depends on a remote service for execution, which means user-provided phone numbers, call tasks, and authentication material leave the local environment. In a telephony skill this is contextually expected, but still dangerous if users are not clearly informed or if the endpoint is not strongly authenticated and documented.
curl -X POST https://api.call-bridge.dev/call \
-H "Content-Type: application/json" \
-H "X-Api-Key: cb_sk_..." \
-d '{
The hardcoded external endpoint shows that the skill depends on a remote service for execution, which means user-provided phone numbers, call tasks, and authentication material leave the local environment. In a telephony skill this is contextually expected, but still dangerous if users are not clearly informed or if the endpoint is not strongly authenticated and documented.
curl -X POST https://api.call-bridge.dev/call \
-H "Content-Type: application/json" \
-H "X-Api-Key: cb_sk_..." \
-d '{
Polling the external API for call status continues transmitting authentication material and retrieving potentially sensitive transcripts and recording links from a third-party service. This is normal for the product’s design, but it increases exposure of call metadata and content if logs, terminals, or downstream tools capture the responses.
# 每3秒轮询一次
curl -H "X-Api-Key: cb_sk_..." \
https://api.call-bridge.dev/call/ba645d75-...
轮询直到lifecycle变为finalized：
The hangup endpoint is another external action that uses the API key and affects a live real-world call. While less sensitive than initiating a call, it still represents a remote control action over telephony resources and confirms that the skill can perform externally impactful operations.
curl -X POST -H "X-Api-Key: cb_sk_..." \
https://api.call-bridge.dev/call/{call_id}/hangup
The display name, summary, and nearly all instructions are presented in Chinese, with no indication that the user can choose another language. This can violate language/locale policy when a skill imposes a specific language without offering an opt-in or alternative.
The input schema introduces a callback_url for asynchronous notifications, but no other section documents a callback API flow or justifies outbound callbacks as part of the stated free-version capabilities. Since the manifest frames the skill around single-call bridging and polling, this appears to add a network interaction capability beyond the described core workflow.