ClawHub
Back to skill

Security audit

CallSimple: AI Phone Calls in Hindi & English (India)

Security checks for vulnerabilities and agentic risk

Overview

The skill provides user-approved phone calls with clear limits; its unpinned CLI installation and handling of recordings warrant ordinary precautions.

Approve each recipient and message carefully. Calls use account minutes and produce recordings and transcripts; the [privacy policy](https://callsimple.app/privacy) says call history remains until deletion is requested or the account is closed. Prefer the hosted MCP connection or a reviewed, pinned CLI revision over automatically fetching the latest GitHub code.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

MCP server referenced without pinned version: 'npx -y github'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The login command executes a GitHub-hosted CLI without pinning an immutable revision, and -y suppresses the installation confirmation. If the upstream repository or its dependencies are compromised, the agent could execute attacker-controlled code with its local permissions, potentially exposing local files or authentication material during sign-in; this is a CLI supply-chain issue rather than an unversioned MCP server issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y github'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The balance command also invokes executable code from a mutable GitHub reference with automatic installation approval. Although checking minutes is benign, the fetched CLI runs with the agent's local permissions and may have access to an authenticated session, so a compromised upstream could steal data or credentials; the call-confirmation safeguards do not mitigate this execution risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.