Security audit

语音通话服务

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly describes a real voice-calling service, but it handles phone numbers, call records, stored credentials, login links, and background polling with insufficient scoping and user control.

Review this skill before installing. It may place real phone calls, process transcripts or recordings, store your API key and phone number, reuse saved numbers, show login or billing links from the service, and set up recurring inbound-call polling. Prefer a version that uses a scoped secret store, asks before saving personal data, never puts API keys in URLs, validates returned links, and provides clear controls to disable and delete stored data or scheduled jobs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:79
Finding: Overbroad Home-Directory Credential Discovery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:56
Finding: Plaintext Persistence of API Credentials and User Phone Numbers
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:89
Finding: Reusable API Key Exposed Through a Login URL Query Parameter
Content: View full analysis
``` The Skill directs the Agent to load the saved API key and construct this URL to associate the Agent with the user's account. ### Technical Analysis A reusable API key is placed directly in a URL query parameter. Query strings are routinely retained by browser history, application logs, reverse proxies, observability platforms, screenshots, clipboard managers, analytics systems, and support tooling. Depending on browser and site policy, the URL may also be exposed through referrer information. This design treats a long-lived API credential as a browser login token without specifying single-use semantics, short expiration, audience restriction, or replay prevention. HTTPS protects the URL in transit but does not prevent disclosure at endpoints or through operational logging. ### Attack Path 1. The Agent reads the stored API key. 2. It constructs and displays or opens the sign-in URL containing the key. 3. The complete URL is recorded in browser history, Agent logs, proxy logs, telemetry, clipboard history, or a screenshot. 4. An attacker obtains the recorded URL. 5. The attacker extracts the `token` value and replays it against the service or uses it as an API credential. 6. The attacker obtains the permissions associated with that key until it is revoked or expires. ### Impact Assessment A leaked key may enable unauthorized account association, API calls, paid calling activity, quota exhaustion, call-history access, or preference changes, subject to the server's authorization model. Because the documented value is an API key rather than an explicitly short-lived exchange token, the exposure may remain useful ac ...[truncated 18 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:223
Finding: Unvalidated Propagation of Server-Controlled Action URLs
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:221
Finding: Cross-Session Inbound Call Polling Through Cron
Content: View full analysis
&limit=25 ``` ### Technical Analysis The Skill directs recurring cron polling, which can continue after the initiating conversation or Agent session. It does not define an explicit installation-consent step, the exact cron entry, credential isolation, a bounded execution period, output location, failure handling, or a removal procedure. The polling operation accesses inbound call history using persistent account credentials. As a result, the scheduled task can repeatedly retrieve potentially sensitive call metadata after the original user interaction has ended. The Skill also requests `exec` access, which may allow an implementing Agent to install the recurring job at the operating-system level. ### Attack Path 1. A user requests inbound-call monitoring. 2. The Agent follows the Skill and creates a cron-based task that runs every 30 minutes. 3. The task retains access to the stored API credential. 4. The original Agent conversation ends, but the scheduled job remains installed. 5. The job continues to contact the service and retrieve inbound call records. 6. Retrieved records or errors may accumulate in local output, logs, email generated by cron, or another storage destination. 7. Anyone with access to those artifacts or the scheduled task may obtain call metadata or credential-related information. ### Impact Assessment The behavior creates cross-session persistence and o ...[truncated 396 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The description says the skill should be used for code generation, programming assistance, debugging, testing, and deployment, which directly conflicts with the documented behavior everywhere else in the file: placing real phone calls via a voice agent. This is not merely incomplete documentation; it actively describes a different class of skill than the one implemented by the surrounding instructions.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill tells the agent to automatically send saved API keys in requests and to embed the raw API key into a sign-in URL query parameter. In this context, that is dangerous because query strings are commonly logged, cached, leaked via browser history, referrers, or telemetry, turning a long-lived credential into an easily exfiltrated token.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation guidance says to use the skill for broad situations like '代码生成、编程辅助、调试测试、开发部署', which are generic software-help contexts unrelated to voice calling and likely to overlap with common requests. It does not clearly constrain when the skill should activate for telephony tasks versus when it should not, making unintended invocation more likely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The highlighted 功能说明 states the skill's core capabilities are Chinese interaction and workflow scenarios, while the document's actual operational instructions center on making real phone calls, bridging users, polling call state, and managing inbound call preferences. This creates intent-level contradiction because the prominent summary names different 'core capabilities' than the actual skill behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs persistent storage of API keys and phone numbers but does not present that behavior as an upfront warning before collection and use. In a telephony context, silent persistence of identifiers and credentials increases the risk of privacy violations, unintended reuse, and later disclosure by the agent or host environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill processes real phone calls, transcripts, and potentially recordings, yet the early description does not clearly warn users that call content may be retained and recording links returned. In this context, insufficient disclosure can lead to collection of sensitive conversational data without informed consent and can create legal and privacy exposure.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly directs the agent to persist user phone numbers and reuse them across future calls, transfers, and inbound handoffs. That creates a real data retention and context-leakage risk: a later prompt, mis-scoped task, or compromised environment could cause the agent to expose or misuse a previously stored personal number.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Nearly the entire document defines this skill as a voice-calling service that returns telephony artifacts such as call_id, lifecycle, transcript, outcome, and recording_url. The final '输出格式' section instead claims a generic wrapper with fields like success, execution_time, metadata, and execution_log, which conflicts with the documented behavior and could mislead an agent about what the skill actually returns.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: 文档在自然语言中明确规定“仅支持美国 +1XXXXXXXXXX 号码，不支持国际号码”。根据给定规则，强制特定语言或地区且未提供用户选择时可能构成政策问题；此处虽是产品范围限制，但未进一步说明合规或技术上的必要理由。
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:144

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md.bak_v161test:179