OpenClaw Phone Receipt

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.0.1

Overview

This skill is mostly aligned with phone callback receipts, but it needs Review because it can place outbound calls, send receipt data through external services, persist behavior, and uses an unsafe env-file loading pattern.

Install only if you are comfortable with an agent placing phone calls through ElevenLabs/Twilio and potentially sending success summaries through Telegram. Configure your own destination number, protect and scope the API key, review the env-file sourcing issue before use, and require explicit user confirmation before any call or persistent receipt policy is enabled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/trigger_call.sh:12

Finding

Arbitrary Command Execution Through Sourced Environment File

Content

View full analysis

Vulnerability Details

File Location: scripts/trigger_call.sh, lines 12-17
Vulnerability Type: Unsafe execution of configuration data
Risk Level: High

Vulnerable Code:

bash

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../" && pwd)"
ENV_FILE="${ENV_FILE:-$ROOT/.env.elevenlabs-call}"

if [[ -f "$ENV_FILE" ]]; then
  # shellcheck disable=SC1090
  set -a; source "$ENV_FILE"; set +a
fi

Technical Analysis

The script loads the selected environment file with the Bash source built-in. source does not treat the file as passive key-value configuration; it interprets every line as shell code in the current process.

The ENV_FILE path can be supplied through an environment variable. Consequently, anyone able to influence that variable or modify the default .env.elevenlabs-call file can introduce command substitutions, function calls, redirections, or arbitrary shell commands. These commands execute with the permissions of the user or agent running the skill.

This is a configuration-to-code injection vulnerability. The use of set -a does not mitigate the issue because it only controls automatic variable export.

Attack Path

1. An attacker creates or modifies an environment file accessible to the victim.
2. The file contains apparently valid configuration followed by a malicious shell command.
3. The attacker causes ENV_FILE to reference that file, or replaces the default workspace configuration file.
4. A user or agent invokes scripts/trigger_call.sh.
5. Bash evaluates the file through source.
6. The malicious command executes before the outbound API request is made.

Exploitation requires control over the selected configuration file, the ENV_FILE environment variable, or the default workspace configuration.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the account running the skill. An attacke ...[truncated 333 chars]

Remediation

View remediation

Remediation Suggestions

• Do not load configuration files with source, ., or eval.
• Parse the file as data using a non-executing dotenv parser.
• Accept only an explicit allowlist of keys:
  • ELEVENLABS_API_KEY
  • ELEVENLABS_AGENT_ID
  • ELEVENLABS_OUTBOUND_PHONE_ID
  • TO_NUMBER
• Reject command substitutions, shell metacharacters, malformed assignments, duplicate keys, and unexpected variables.
• Resolve the configuration file to an approved path rather than accepting an unrestricted caller-provided ENV_FILE.
• Verify that the file is a regular file owned by the expected user and is not writable by other users.
• Require restrictive permissions such as 0600.
• Validate each parsed value before using it, including strict E.164 validation for TO_NUMBER.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/trigger_call.sh:38

Finding

ElevenLabs API Key Exposed in Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/trigger_call.sh, lines 38-41
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

bash

resp=$(curl -sS -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \
  -H "xi-api-key: ${ELEVENLABS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$payload")

Technical Analysis

The API key is expanded directly into a curl command-line argument. While the request is in progress, the resulting argument may be observable through process inspection facilities, local monitoring software, audit systems, debugging tools, or command-line telemetry.

This unnecessarily broadens secret exposure beyond the outbound HTTPS request. TLS protects the key during network transit but does not protect it from local process inspection or logging.

Attack Path

1. A legitimate user or automated agent invokes scripts/trigger_call.sh.
2. The script starts curl with the ElevenLabs API key embedded in the header argument.
3. A local observer, diagnostic agent, or process-monitoring service captures the curl command line while it is running.
4. The observer extracts the value supplied in the xi-api-key header.
5. The recovered credential is used to access ElevenLabs APIs within its assigned permissions and service limits.

Exploitation requires local process-observation access or access to logs that record process arguments.

Impact Assessment

Exposure compromises the ElevenLabs API key. The resulting capabilities depend on the key's configured scopes, but may include initiating calls, accessing ConvAI resources, consuming paid quota, or obtaining data available to the credential. The issue does not directly grant operating-system privileges; its primary scope is the ElevenLabs account and resources authorized to the exposed key.

Remediation

View remediation

Remediation Suggestions

• Avoid embedding secret header values directly in command-line arguments.
• Supply the sensitive header through a protected temporary curl configuration, standard input, or another mechanism that does not place the key in the process argument list.
• If a temporary file is necessary, create it securely with permissions set to 0600, use a restrictive umask, and remove it through a reliable cleanup trap.
• Ensure debug output, shell tracing, request logs, and process telemetry cannot record the secret.
• Use a dedicated API key with only the minimum scopes needed to initiate outbound calls.
• Rotate the key if process arguments may previously have been captured.
• Apply usage limits and monitor the account for unexpected calls or API activity.

T09 · Insecure Skill Coding Practices

Note

• Location: references/env-example.txt:6

Finding

Complete Recipient Phone Number Included in Distributable Configuration Examples

Content

View full analysis

Vulnerability Details

File Locations: references/env-example.txt, line 6; references/setup.md, line 16
Vulnerability Type: Hard-coded sensitive recipient data and unsafe operational default
Risk Level: Low

Vulnerable Code:

references/env-example.txt:

text

# Copy to workspace/.env.elevenlabs-call

ELEVENLABS_API_KEY=
ELEVENLABS_AGENT_ID=
ELEVENLABS_OUTBOUND_PHONE_ID=
TO_NUMBER=[phone]

references/setup.md:

text

- `TO_NUMBER` (target number in E.164, example: `[phone]`)

Technical Analysis

The distributed configuration template contains a syntactically valid, complete phone number rather than an empty value or an unmistakably non-operational placeholder. The same number is repeated in the setup documentation.

Users commonly copy example environment files and populate only blank credential fields. Because TO_NUMBER is already populated, the call script's required-variable check will accept it. If the example belongs to a real subscriber, publication may also disclose personal contact information.

Attack Path

1. A user copies references/env-example.txt to the expected workspace environment file.
2. The user fills in the ElevenLabs API key and service identifiers but overlooks the populated TO_NUMBER.
3. The user runs the documented call test.
4. The script accepts the existing number as valid configuration.
5. ElevenLabs attempts to place a call to the hard-coded recipient.

This path does not require a malicious local attacker; ordinary use of the provided template can trigger the issue.

Impact Assessment

The recipient may receive unintended or repeated calls, while the skill operator may incur call charges and consume service quota. If the number identifies a real person, its inclusion in a published skill package creates a privacy concern. This issue does not provide system privileges or code execution.

Remediation

View remediation

Remediation Suggestions

• Replace the populated value with an empty assignment such as TO_NUMBER=.
• Alternatively, use an unmistakably fictitious placeholder and ensure it cannot accidentally route a real call.
• Update all documentation to use redacted examples such as +1XXXXXXXXXX.
• Require users to explicitly configure and confirm the destination number before the first call.
• Validate TO_NUMBER against E.164 syntax, while recognizing that syntax validation alone cannot establish recipient ownership or consent.
• Consider an interactive confirmation or separately stored approval flag for test calls.
• If the published number belongs to a real person, remove it from repository history where feasible and assess whether privacy notification is necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code does perform part of the declared purpose: it triggers an outbound phone call using ElevenLabs/Twilio-related infrastructure. However, the description claims broader functionality to 'trigger and manage' phone receipts, including fixed command toggles, persistence across sessions, and use for task completion/failure notifications. This code chunk only initiates a single outbound call based on environment variables and does not implement state management, toggles, persistence, or task-status-driven notification logic. Therefore the description overstates what this specific code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to read environment-backed secrets, write persistent state, and execute shell scripts, but it does not declare any explicit tool scope or permissions boundary. This increases the chance of over-broad execution in environments that rely on manifest-declared permissions, making secret access and command execution less visible to reviewers and users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation language is broad enough to match common conversational requests such as asking to call after a task or persist behavior across sessions. In an agentic environment, that can cause the skill to trigger in unintended contexts, leading to unauthorized outbound calls, state changes, or disclosure of task-related information to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill does not clearly warn users that enabling the feature will place outbound calls and send phone-related data to ElevenLabs and Twilio. Without explicit disclosure and consent, users may unknowingly trigger communications and expose personal contact information or task metadata to third parties.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill expands from phone receipts into Telegram message delivery without declaring that additional external channel in the metadata or warning the user. That can lead to unexpected transmission of task summaries to a separate service, increasing privacy and data-sharing risk beyond the stated purpose of the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide says the default runtime policy is to call only on task failure or urgency, while the skill metadata says it should also support calling after task completion. This mismatch can cause operators or downstream agents to misunderstand when outbound phone calls are triggered, leading to missed notifications or unintended suppression of expected completion calls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/trigger_call.sh (reported line 38)May include surrounding context.

sh

PY
)

resp=$(curl -sS -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \
  -H "xi-api-key: ${ELEVENLABS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$payload")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/trigger_call.sh (reported line 38)May include surrounding context.

sh

PY
)

resp=$(curl -sS -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \
  -H "xi-api-key: ${ELEVENLABS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$payload")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script immediately places an outbound phone call once the required environment variables are present, with no interactive confirmation, policy gate, or proof of recent user consent. In an agent-skill context, this can lead to unintended or unauthorized calls, creating privacy, billing, and harassment risk if triggered automatically or by prompt manipulation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example value [phone] implies a Philippines-specific phone number format and locale choice in a natural-language/config example. The file does not indicate that this locale is optional, user-selectable, or required for a region-specific use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.