OpenClaw Phone Receipt

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.0.1

Overview

This skill is mostly aligned with phone callback receipts, but it needs Review because it can place outbound calls, send receipt data through external services, persist behavior, and uses an unsafe env-file loading pattern.

Install only if you are comfortable with an agent placing phone calls through ElevenLabs/Twilio and potentially sending success summaries through Telegram. Configure your own destination number, protect and scope the API key, review the env-file sourcing issue before use, and require explicit user confirmation before any call or persistent receipt policy is enabled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/trigger_call.sh:12
• Finding: Arbitrary Command Execution Through Sourced Environment File## Vulnerability Details **File Location**: `scripts/trigger_call.sh`, lines 12-17 **Vulnerability Type**: Unsafe execution of configuration data **Risk Level**: High **Vulnerable Code**: ```bash ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../" && pwd)" ENV_FILE="${ENV_FILE:-$ROOT/.env.elevenlabs-call}" if [[ -f "$ENV_FILE" ]]; then # shellcheck disable=SC1090 set -a; source "$ENV_FILE"; set +a fi ``` ### Technical Analysis The script loads the selected environment file with the Bash `source` built-in. `source` does not treat the file as passive key-value configuration; it interprets every line as shell code in the current process. The `ENV_FILE` path can be supplied through an environment variable. Consequently, anyone able to influence that variable or modify the default `.env.elevenlabs-call` file can introduce command substitutions, function calls, redirections, or arbitrary shell commands. These commands execute with the permissions of the user or agent running the skill. This is a configuration-to-code injection vulnerability. The use of `set -a` does not mitigate the issue because it only controls automatic variable export. ### Attack Path 1. An attacker creates or modifies an environment file accessible to the victim. 2. The file contains apparently valid configuration followed by a malicious shell command. 3. The attacker causes `ENV_FILE` to reference that file, or replaces the default workspace configuration file. 4. A user or agent invokes `scripts/trigger_call.sh`. 5. Bash evaluates the file through `source`. 6. The malicious command executes before the outbound API request is made. Exploitation requires control over the selected configuration file, the `ENV_FILE` environment variable, or the default workspace configuration. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the account running the skill. An attacke ...[truncated 333 chars]
• Remediation: ## Remediation Suggestions - Do not load configuration files with `source`, `.`, or `eval`. - Parse the file as data using a non-executing dotenv parser. - Accept only an explicit allowlist of keys: - `ELEVENLABS_API_KEY` - `ELEVENLABS_AGENT_ID` - `ELEVENLABS_OUTBOUND_PHONE_ID` - `TO_NUMBER` - Reject command substitutions, shell metacharacters, malformed assignments, duplicate keys, and unexpected variables. - Resolve the configuration file to an approved path rather than accepting an unrestricted caller-provided `ENV_FILE`. - Verify that the file is a regular file owned by the expected user and is not writable by other users. - Require restrictive permissions such as `0600`. - Validate each parsed value before using it, including strict E.164 validation for `TO_NUMBER`.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/trigger_call.sh:38
• Finding: ElevenLabs API Key Exposed in Process Command-Line Arguments## Vulnerability Details **File Location**: `scripts/trigger_call.sh`, lines 38-41 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium **Vulnerable Code**: ```bash resp=$(curl -sS -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \ -H "xi-api-key: ${ELEVENLABS_API_KEY}" \ -H "Content-Type: application/json" \ -d "$payload") ``` ### Technical Analysis The API key is expanded directly into a `curl` command-line argument. While the request is in progress, the resulting argument may be observable through process inspection facilities, local monitoring software, audit systems, debugging tools, or command-line telemetry. This unnecessarily broadens secret exposure beyond the outbound HTTPS request. TLS protects the key during network transit but does not protect it from local process inspection or logging. ### Attack Path 1. A legitimate user or automated agent invokes `scripts/trigger_call.sh`. 2. The script starts `curl` with the ElevenLabs API key embedded in the header argument. 3. A local observer, diagnostic agent, or process-monitoring service captures the `curl` command line while it is running. 4. The observer extracts the value supplied in the `xi-api-key` header. 5. The recovered credential is used to access ElevenLabs APIs within its assigned permissions and service limits. Exploitation requires local process-observation access or access to logs that record process arguments. ### Impact Assessment Exposure compromises the ElevenLabs API key. The resulting capabilities depend on the key's configured scopes, but may include initiating calls, accessing ConvAI resources, consuming paid quota, or obtaining data available to the credential. The issue does not directly grant operating-system privileges; its primary scope is the ElevenLabs account and resources authorized to the exposed key.
• Remediation: ## Remediation Suggestions - Avoid embedding secret header values directly in command-line arguments. - Supply the sensitive header through a protected temporary curl configuration, standard input, or another mechanism that does not place the key in the process argument list. - If a temporary file is necessary, create it securely with permissions set to `0600`, use a restrictive `umask`, and remove it through a reliable cleanup trap. - Ensure debug output, shell tracing, request logs, and process telemetry cannot record the secret. - Use a dedicated API key with only the minimum scopes needed to initiate outbound calls. - Rotate the key if process arguments may previously have been captured. - Apply usage limits and monitor the account for unexpected calls or API activity.

T09 · Insecure Skill Coding Practices

Note

• Location: references/env-example.txt:6
• Finding: Complete Recipient Phone Number Included in Distributable Configuration Examples## Vulnerability Details **File Locations**: `references/env-example.txt`, line 6; `references/setup.md`, line 16 **Vulnerability Type**: Hard-coded sensitive recipient data and unsafe operational default **Risk Level**: Low **Vulnerable Code**: `references/env-example.txt`: ```text # Copy to workspace/.env.elevenlabs-call ELEVENLABS_API_KEY= ELEVENLABS_AGENT_ID= ELEVENLABS_OUTBOUND_PHONE_ID= TO_NUMBER=[phone] ``` `references/setup.md`: ```text - `TO_NUMBER` (target number in E.164, example: `[phone]`) ``` ### Technical Analysis The distributed configuration template contains a syntactically valid, complete phone number rather than an empty value or an unmistakably non-operational placeholder. The same number is repeated in the setup documentation. Users commonly copy example environment files and populate only blank credential fields. Because `TO_NUMBER` is already populated, the call script's required-variable check will accept it. If the example belongs to a real subscriber, publication may also disclose personal contact information. ### Attack Path 1. A user copies `references/env-example.txt` to the expected workspace environment file. 2. The user fills in the ElevenLabs API key and service identifiers but overlooks the populated `TO_NUMBER`. 3. The user runs the documented call test. 4. The script accepts the existing number as valid configuration. 5. ElevenLabs attempts to place a call to the hard-coded recipient. This path does not require a malicious local attacker; ordinary use of the provided template can trigger the issue. ### Impact Assessment The recipient may receive unintended or repeated calls, while the skill operator may incur call charges and consume service quota. If the number identifies a real person, its inclusion in a published skill package creates a privacy concern. This issue does not provide system privileges or code execution.
• Remediation: ## Remediation Suggestions - Replace the populated value with an empty assignment such as `TO_NUMBER=`. - Alternatively, use an unmistakably fictitious placeholder and ensure it cannot accidentally route a real call. - Update all documentation to use redacted examples such as `+1XXXXXXXXXX`. - Require users to explicitly configure and confirm the destination number before the first call. - Validate `TO_NUMBER` against E.164 syntax, while recognizing that syntax validation alone cannot establish recipient ownership or consent. - Consider an interactive confirmation or separately stored approval flag for test calls. - If the published number belongs to a real person, remove it from repository history where feasible and assess whether privacy notification is necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The code does perform part of the declared purpose: it triggers an outbound phone call using ElevenLabs/Twilio-related infrastructure. However, the description claims broader functionality to 'trigger and manage' phone receipts, including fixed command toggles, persistence across sessions, and use for task completion/failure notifications. This code chunk only initiates a single outbound call based on environment variables and does not implement state management, toggles, persistence, or task-status-driven notification logic. Therefore the description overstates what this specific code actually does.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read environment-backed secrets, write persistent state, and execute shell scripts, but it does not declare any explicit tool scope or permissions boundary. This increases the chance of over-broad execution in environments that rely on manifest-declared permissions, making secret access and command execution less visible to reviewers and users.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation language is broad enough to match common conversational requests such as asking to call after a task or persist behavior across sessions. In an agentic environment, that can cause the skill to trigger in unintended contexts, leading to unauthorized outbound calls, state changes, or disclosure of task-related information to external services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill does not clearly warn users that enabling the feature will place outbound calls and send phone-related data to ElevenLabs and Twilio. Without explicit disclosure and consent, users may unknowingly trigger communications and expose personal contact information or task metadata to third parties.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill expands from phone receipts into Telegram message delivery without declaring that additional external channel in the metadata or warning the user. That can lead to unexpected transmission of task summaries to a separate service, increasing privacy and data-sharing risk beyond the stated purpose of the skill.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The setup guide says the default runtime policy is to call only on task failure or urgency, while the skill metadata says it should also support calling after task completion. This mismatch can cause operators or downstream agents to misunderstand when outbound phone calls are triggered, leading to missed notifications or unintended suppression of expected completion calls.

External Transmission

Medium

• Category: Data Exfiltration

Content

PY
)

resp=$(curl -sS -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \
  -H "xi-api-key: ${ELEVENLABS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$payload")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

PY
)

resp=$(curl -sS -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \
  -H "xi-api-key: ${ELEVENLABS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$payload")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script immediately places an outbound phone call once the required environment variables are present, with no interactive confirmation, policy gate, or proof of recent user consent. In an agent-skill context, this can lead to unintended or unauthorized calls, creating privacy, billing, and harassment risk if triggered automatically or by prompt manipulation.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The example value `[phone]` implies a Philippines-specific phone number format and locale choice in a natural-language/config example. The file does not indicate that this locale is optional, user-selectable, or required for a region-specific use case.

Static analysis

No suspicious patterns detected.