Security audit

语音通话服务

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a disclosed phone-calling assistant, but it has overbroad activation text and weak handling of stored phone numbers, API keys, transcripts, and recordings.

Review this carefully before installing. Use it only for explicit phone-call tasks, avoid relying on it for coding or generic automation, and do not allow it to store or reuse your API key or phone number unless you understand where that data is kept and how to remove it. Confirm consent and local recording rules before calls that may produce transcripts or recordings.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill description advertises code generation and programming assistance, while the actual body describes an automated real-world telephony service. This mismatch can cause unsafe invocation, user confusion, and inappropriate trust decisions because agents may activate the skill in contexts unrelated to phone calling and expose users to unintended external actions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The feature summary uses generic claims about Chinese interaction and workflow capabilities instead of clearly describing the phone-calling behavior. In a skill that can trigger external calls, vague summaries increase the chance of accidental use and reduce informed user consent.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documented output format refers to generic processing steps rather than actual telephony operations and outcomes. Misleading outputs can cause downstream agents or users to misunderstand whether a call was placed, what data was collected, and whether sensitive artifacts like transcripts or recordings exist.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The troubleshooting and onboarding sections mention unrelated file handling and command execution workflows, even though the skill is for telephony. In a skill with declared tools like exec/write/read, this broadens perceived capability and can steer an agent toward unsafe local actions not required for the stated purpose.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The typical scenarios list unrelated data extraction, querying, and ops automation capabilities that contradict the voice-call purpose. This overbroad positioning can encourage misuse of the skill as a general automation component and increase the chance of unnecessary access to local tools or data.

Intent-Code Divergence

Low

Confidence: 96% confidence
Finding: The skill gives contradictory persistence instructions, telling the agent to check `~/.json` while earlier documenting `~/.config/voicecall/key.json` as the storage location for API keys and phone numbers. Ambiguous secret-storage paths can cause credentials to be written to or read from unintended files, increasing the risk of accidental exposure, misuse across skills, or failure to apply correct filesystem protections.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The API key configuration section instructs users to set `export API_KEY=...`, which conflicts with the earlier model of auto-issued, persisted `voicecall` credentials. This inconsistency can lead to agents pulling credentials from the wrong source, leaking them into shell history or process environments, or mishandling account association and rotation.

Vague Triggers

High

Confidence: 97% confidence
Finding: The activation language is overly broad and not tied to the narrow phone-calling purpose, which can cause the skill to trigger in unrelated contexts. Because this skill performs external real-world actions, overbroad activation materially increases the risk of accidental invocation and unintended disclosure through calls.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The skill instructs persistent storage of API keys and user phone numbers, but does not present a clear user-facing consent and retention warning before doing so. Storing credentials and personal phone numbers on disk creates substantial privacy and account-security risk if the host is shared, compromised, or logs are exposed.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill returns transcripts and recording links from real phone calls without a prominent upfront consent and privacy warning. In telephony contexts, call content may include sensitive personal, financial, or health information, and recording legality varies by jurisdiction, making silent collection or disclosure especially dangerous.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs persistent storage of both API keys and user phone numbers but does not clearly warn users that these identifiers will be retained locally and reused for future calls and account-linking flows. Because the skill handles real-world telephony and account tokens, silent retention creates privacy and security risk if the host is shared, compromised, or synced to other systems.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill enables outbound calls, transcripts, and recording links involving real people, but the high-level description does not clearly foreground consent, recording-law, and privacy implications. In a telephony context, failing to present explicit warnings can cause users to trigger monitoring or recording workflows without understanding legal or privacy consequences for themselves or call recipients.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:144

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md.bak_v161test:179