语音通话服务-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.4

Overview

The skill’s phone-calling purpose is legitimate, but it handles real outbound calls, credentials, phone numbers, transcripts, and local files with unclear and overbroad controls.

Review this before installing. Use it only if you are comfortable with an agent placing real U.S. phone calls, sending the target number and task details to the external voice-call service, and receiving transcripts. Do not let it read generic credential files or a broad key store; use a service-specific secret entry, avoid putting API keys in URLs, and require explicit confirmation before every call.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:44

Finding

Ambiguous Credential-File Access May Expose Unrelated Secrets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-52 and 127-131
Vulnerability Type: Overbroad credential access and unvalidated secret transmission
Risk Level: High

Relevant snippets:

text

在任何涉及语音通话服务的对话开始时，检查 `~/.json` 或宿主密钥库。若存在API密钥，作为 `X-Api-Key` 发送。

首次未鉴权的 `POST /call` 响应可能包含 `api_key`。立即保存：

{
  "api_key": "voicecall_sk_...",
  "user_phone_number": "[phone]"
}

text

`~/.json` 保存API密钥与用户电话号码，跨会话复用。

1. **检查持久状态**：读 `~/.json`，若有 `api_key` 则作为 `X-Api-Key` 发送。

Technical Analysis

The Skill instructs the Agent to inspect the generic path ~/.json or a host credential store whenever a voice-call conversation begins. This path is inconsistent with the service-specific ~/.config/voicecall/key.json path documented elsewhere.

A generic home-directory JSON file may belong to another application. The instructions do not require validation of the file owner, schema, provenance, service identifier, or credential prefix before transmitting a discovered value through the X-Api-Key header. Access to an undifferentiated host credential store is also broader than the task requires.

Attack Path

1. An unrelated application or user creates ~/.json containing a field named api_key.
2. The Skill is activated for a voice-call request.
3. The Agent follows the instruction to read ~/.json or search a host credential store.
4. The unrelated credential is interpreted as the voice-call API key.
5. The Agent transmits that credential to the configured external API in the X-Api-Key header.
6. The external service, its infrastructure, or network logs may obtain the unrelated secret.

Impact Assessment

Exploitation may disclose credentials belonging to another application or service. The resulting privileges are determined by the exposed credential and could extend beyond the voice-call service. The issue breaks least-privilege boundaries by directing acce ...[truncated 72 chars]

Remediation

View remediation

Remediation Suggestions

• Read only a service-specific path such as ~/.config/voicecall/key.json.
• Do not enumerate or inspect a general host credential store. Request only an exact, service-specific credential entry.
• Validate an exact JSON schema, expected service identifier, and voicecall_sk_ prefix before using a stored value.
• Confirm the destination host against an explicit allowlist before transmitting credentials.
• Require explicit user authorization before loading or sending an existing credential.
• Reject files that are symbolic links, have unexpected ownership, or have permissions allowing access by other users.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:46

Finding

API Key and Personal Telephone Number Persisted in Plaintext

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35 and 46-52
Vulnerability Type: Insecure storage of authentication and personal data
Risk Level: High

Relevant snippets:

text

**输出**: `call_id` 与 `api_key`（首次外呼自动签发并保存至 `~/.config/voicecall/key.json`）、通话生命周期状态（`queued` → `dialing` → `answered` → `finalized`）、终态返回 `outcome`（电话网络结果）、`talk_seconds`（通话时长）、`transcript`（通话转录）。

text

首次未鉴权的 `POST /call` 响应可能包含 `api_key`。立即保存：

{
  "api_key": "voicecall_sk_...",
  "user_phone_number": "[phone]"
}

Technical Analysis

The Skill requires immediate, cross-session storage of a reusable API key and a user's telephone number in a plaintext JSON file. It does not specify restrictive file permissions, encryption, secure file creation, user consent, a retention period, deletion behavior, or credential rotation.

This behavior also conflicts with the later security guidance warning against storing API keys in configuration files. Merely placing a secret below ~/.config does not protect it from other local processes running under the same account, insecure backups, accidental synchronization, or overly permissive filesystem modes.

Attack Path

1. The external API returns an api_key after an unauthenticated initial call.
2. The Agent writes the key and user telephone number to a JSON file.
3. The file is created with default or otherwise insufficiently restrictive permissions.
4. Another process, backup service, synchronization tool, diagnostic collector, or accidental repository operation reads the file.
5. The API key is reused to impersonate the user or access the associated service, while the telephone number is exposed as personal data.

Impact Assessment

Exposure of the reusable API key could allow unauthorized API requests and actions available to the associated account. The stored telephone number creates an additional privacy risk. The scope includes future sess ...[truncated 68 chars]

Remediation

View remediation

Remediation Suggestions

• Store the API key in the operating system credential manager or a platform-provided secret store.
• Do not persist the user's telephone number unless it is strictly required for later operations.
• Obtain explicit consent before retaining any credential or personal data across sessions.
• If a file is unavoidable, create its parent directory with owner-only permissions and create the file atomically with mode 0600.
• Verify file ownership and reject symbolic links before reading or writing.
• Encrypt sensitive data at rest using a key that is not stored beside the encrypted file.
• Define retention, deletion, revocation, and rotation procedures.
• Ensure secrets are redacted from console output, transcripts, telemetry, exception messages, and backups.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:179

Finding

Reusable API Key Embedded in an Account-Linking URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 179
Vulnerability Type: Sensitive credential exposure through a URL query parameter
Risk Level: High

Complete vulnerable snippet:

text

- **账户关联**：通过 `https://voicecall.example/sign-in?token=<api_key>` 关联代理到账户。

Technical Analysis

The account-linking instruction places a reusable API key in a URL query parameter. Query strings are routinely retained by browser history, HTTP server logs, reverse proxies, monitoring products, endpoint telemetry, screenshots, clipboard history, and analytics systems. Depending on referrer policy and navigation behavior, the URL may also be disclosed as referrer data.

TLS protects the URL while it is in transit but does not prevent its storage or exposure at either endpoint or in local browser artifacts.

Attack Path

1. The Agent substitutes the persistent API key into the token query parameter.
2. The resulting URL is opened, copied, displayed, or passed to another application.
3. The full URL is recorded in browser history, access logs, proxy telemetry, clipboard history, or monitoring data.
4. A party with access to one of those records extracts the API key.
5. The exposed key is replayed against the service to obtain whatever privileges the credential grants.

Impact Assessment

An attacker may gain the API privileges associated with the exposed key, potentially including account association or unauthorized service use. Because the documentation treats the key as persistent, exposure may remain exploitable until the credential is revoked or rotated.

Remediation

View remediation

Remediation Suggestions

• Never place a reusable API key in a URL.
• Implement a short-lived, single-use account-linking code that is distinct from the API credential.
• Exchange the one-time code through a POST request or a standard authorization flow.
• Apply a short expiration time, audience restriction, one-time-use enforcement, and replay protection.
• Configure log and telemetry systems to redact all authentication parameters.
• Rotate any API key previously exposed through this mechanism.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Inconsistent Tool Declarations Grant Unnecessary Execution and Write Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 18-21; line 189; lines 263-267
Vulnerability Type: Excessive and inconsistent Agent tool permissions
Risk Level: Medium

Relevant snippets:

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

text

| `network_error` | 网络抖动 | 等待后执行ping命令测试网络连通性,检查防火墙和代理设置连接后重新执行命令一次，二次失败提示用户执行ping命令测试网络连通性,检查防火墙和代理设置 |

text

- **自动化执行**: 基于指令驱动的自动化流程
- **文件处理**: 支持多种文件格式的读取、解析和写入操作
- **API集成**: 通过标准化接口调用外部服务并处理响应
- **命令执行**: 在安全沙箱中执行系统命令并收集结果
- **信息检索**: 快速搜索和过滤目标数据

Technical Analysis

The Skill's metadata provides conflicting permission declarations: allowed-tools lists read and exec, while the separate tools list also includes write. The core workflow requires HTTPS requests and narrowly scoped credential handling, but broad command execution and general filesystem access are not necessary for initiating and polling a call.

The network-error procedure directs the Agent to run a ping command without defining an exact executable, fixed destination, argument allowlist, timeout, or output limit. Although the document advises against concatenating user input into commands, no enforceable control implements that recommendation.

Attack Path

1. A host interprets the broader tool declaration and grants exec, general read access, and write access.
2. User-controlled content enters the task, troubleshooting context, hostname, proxy setting, or related instruction.
3. The Agent constructs or selects a diagnostic command using that context.
4. If arguments are not strictly constrained, command metacharacters or unsafe options may be interpreted by a shell.
5. The command executes with the Agent process's operating-system privileges, or the write tool modifies files outside the minimum state-storage location.

No explicit command-construction implementation is present, so comma ...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec and general-purpose write access from the Skill.
• Use a dedicated HTTPS client restricted to the explicitly approved API origin.
• Use a narrowly scoped secret-storage tool rather than general filesystem access.
• Make all tool declarations consistent so hosts cannot select a broader permission set.
• If connectivity diagnostics are essential, expose a fixed diagnostic operation rather than a shell.
• Use a constant destination, fixed arguments, strict timeout, output-size limit, and no shell interpretation.
• Never incorporate user-provided telephone numbers, task text, hostnames, proxy values, or transcript content into command lines.
• Enforce network and filesystem restrictions at the sandbox level rather than relying only on prose guidance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill places real outbound phone calls and sends call content to an external service, yet it lacks a prominent requirement for explicit user confirmation and privacy warning before transmitting phone numbers, instructions, and potentially sensitive conversational content. In this context, the absence of a consent gate is dangerous because the action affects third parties in the real world and can disclose personal or business information externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest presents a narrow phone-calling skill, but the body expands scope to generic agent orchestration, file processing, information retrieval, and command execution. This broader framing can cause an agent to apply powerful tools outside the intended task boundary, increasing the chance of unnecessary data access or command use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation description is overly broad and ambiguous, encouraging use for general LLM, agent orchestration, and automation scenarios rather than a narrowly scoped telephony task. Overbroad invocation criteria can cause the skill to be selected in inappropriate contexts where its read/exec/write capabilities and external call behavior create unnecessary risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description states '支持中文交互' in a way that presents Chinese as the required interaction mode, but it does not offer language selection or explain a justified locale restriction. This can violate language or locale policy when the skill is presented as generally applicable rather than region-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The combination of read/write tooling and instructions to retain secrets across sessions makes the skill materially more dangerous than a stateless API-calling skill. Because the skill can both fetch and store local data, compromise or misuse could affect more than the current interaction and broaden the blast radius to future sessions.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

tools:
  - exec
  - read
  - write

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The combination of read/write tooling and instructions to retain secrets across sessions makes the skill materially more dangerous than a stateless API-calling skill. Because the skill can both fetch and store local data, compromise or misuse could affect more than the current interaction and broaden the blast radius to future sessions.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

tools:
  - exec
  - read
  - write

---

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to persist and reuse sensitive data including API keys and a user-associated phone number across sessions, apparently in local files such as ~/.json or ~/.config paths. Cross-session secret retention increases exposure to credential theft, accidental reuse in the wrong context, and privacy leakage, especially because the storage location is inconsistently documented and not described as encrypted or access-controlled.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file first states that an API key must be configured via environment variable, but elsewhere says the first outbound call can automatically issue an API key and persist it locally. These are contradictory operator instructions about the core authentication flow, not merely incomplete documentation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow tells the agent to read and report call transcripts, which may contain personal, financial, health, or other sensitive information obtained from third parties during phone calls. Without minimization or redaction requirements, the agent may unnecessarily expose sensitive content back to the user or into logs and downstream systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to run network-diagnostic shell commands such as ping in response to API/network errors, despite the skill's primary purpose being phone-call orchestration. Introducing shell execution for troubleshooting expands the attack surface and can enable command misuse, environmental probing, or unsafe parameterization in agent implementations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The output section says the API key is saved to ~/.config/voicecall/key.json, while the persistent-state and workflow sections instruct reading and writing ~/.json. These paths actively disagree about where sensitive state is stored, which can mislead operators and downstream tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The core-capability section tells the agent not to ask the user for information it could query itself from public or commercial sources. Independent information gathering is a separate capability from placing and polling voice calls, and the manifest does not explicitly declare research or retrieval as part of the skill's purpose.

Content

No source excerpt is available for this finding.