语音通话服务-免费版

• Outcome: Review
• Latest audit: Aug 10, 2026 · 9:04 AM UTC
• Version: 1.0.4

Overview

The skill’s phone-calling purpose is understandable, but it asks for broad activation and persistent handling of API keys and phone numbers without clear user consent or scoping.

Review before installing. Use this only if you are comfortable with an agent placing real phone calls, sending call instructions to an external service, returning transcripts, and storing an API key plus phone number locally. Prefer explicit consent before each call and before credential storage, and ask the publisher to narrow the trigger text and document secure key deletion or rotation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill's security guidance says outputs should not contain sensitive data, yet earlier sections explicitly document returning `api_key` in results. That inconsistency can cause downstream agents or users to expose credentials in chat logs, traces, or other untrusted sinks, enabling unauthorized API use.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation advises environment-variable-based secret handling, but the workflow also auto-issues and persists API keys to local files. This contradictory guidance undermines secure secret management and increases the chance that credentials are written to weakly protected locations and reused without user awareness.

Vague Triggers

High

• Confidence: 86% confidence
• Finding: The invocation description is so broad that the skill could be selected for many unrelated AI, agent, or automation requests. In context, this is more dangerous because the skill has `exec`, `read`, and `write` capabilities plus real-world calling behavior, so over-triggering can lead to unnecessary credential access, file access, or outbound actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs automatic local storage of a newly issued API key without a clear, upfront warning or consent step. Silent credential persistence creates cross-session exposure risk, especially on shared systems or where agents have broad file access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow tells the agent to read and reuse persisted API keys at the start of a conversation without clearly warning the user that prior secrets will be accessed. This weakens user control and can unexpectedly expose or act on credentials from earlier sessions.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Persisting user phone numbers and returning full call transcripts creates a natural-language data leakage path for sensitive personal or business information. Because transcripts may include authentication details, account data, or private conversations, storing and replaying them expands privacy and compliance risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill instructs immediate saving of newly received secrets together with associated user data for future reuse. Combining credentials and identifying data in persistent storage increases blast radius if the file is read by another tool, agent, or local user.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Reading persistent state containing prior credentials and user data at the start of every conversation normalizes silent cross-session data access. In an agent environment, that raises the chance of unrelated tasks inheriting or exposing sensitive material they do not need.

Session Persistence

Medium

• Category: Rogue Agent

Content

tools:
  - exec
  - read
  - write

---

• Confidence: 88% confidence
• Finding: The skill declares `write` capability and describes session persistence for API keys and user phone numbers. In this context, persistence is security-relevant because it enables durable storage of secrets and personal data that can later be accessed or misused across sessions.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:86