Security audit

Call Bridge

Security checks for vulnerabilities and agentic risk

Overview

This is a real phone-call automation skill, but its documentation is inconsistent and lacks clear safeguards for consent, live calls, credentials, and transcript reuse.

Review this carefully before installing. It can direct an agent to place real phone calls, bridge you into calls, configure inbound forwarding, and reuse call transcripts. Only use it with explicit confirmation before every call, clear participant consent where required, a trusted credential-storage method, and strict limits on storing or replaying transcript content.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The documented input/output contract describes a grading or content-review tool rather than a telephony skill, which creates a severe specification mismatch. In an agentic environment, that can cause the model or orchestrator to collect the wrong inputs, emit misleading outputs, or trigger unexpected downstream actions, especially when real phone calls and account-linked actions are involved.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The description claims the skill is for project management and team collaboration, while the body implements real-world calling and transfer behavior. This mismatch can trick users or agents into invoking a telephony skill under a benign-seeming context, increasing the chance of unintended external calls, privacy violations, or misuse of exec/network capabilities.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill gives conflicting key-management guidance: examples read API keys from local files while the security section recommends environment variables. In practice, inconsistent secret-handling guidance leads to insecure storage, accidental logging, and broader secret exposure across local files and agent sessions.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The API key storage path is inconsistent and appears contradictory to earlier examples, which can cause users or agents to search multiple locations for credentials and persist them insecurely. Ambiguity around secret locations increases the risk of accidental disclosure, improper permissions, and secret sprawl.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill discusses transcription, transfer, and private post-handoff conversations without a clear warning about consent, recording laws, or privacy obligations. In a telephony context, omission of consent and notice requirements can expose users and operators to unlawful recording, unauthorized monitoring, and disclosure of sensitive communications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow examples show commands that place real external calls and bridge calls to user phone numbers, but they do not prominently warn that these actions have real-world effects. In agent environments, lack of explicit action-risk disclosure can lead to accidental calling, unwanted charges, harassment, or routing sensitive conversations to the wrong person.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Directing the agent to reuse prior call transcripts in later interactions can propagate sensitive information far beyond the original context. Transcript replay risks over-disclosure of personal, financial, health, or account data to third parties and may violate data minimization and purpose-limitation expectations.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The example follow-up workflow instructs inclusion of prior transcript content plus newly supplied order details in a new call, which normalizes onward disclosure of conversation history. This can leak identifiers or sensitive operational details to external parties without necessity or fresh consent.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Guidance to store call state locally and embed previous transcript text into future call instructions promotes persistent retention and repeated disclosure of call contents. Local storage expands the attack surface for sensitive data, while transcript reuse increases the likelihood of unnecessary sharing and long-term privacy harm.

Static analysis

No suspicious patterns detected.