ClawHub
Back to skill

Security audit

ClawCall - AI Phone Calls

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ClawCall phone-calling client that can place real calls only after confirmation, with expected token storage and API access.

Install only if you want OpenClaw to make or manage real ClawCall phone calls. Review call details and cost before approving --confirm actions, protect the local token file, and avoid putting passwords, one-time codes, payment details, or unnecessary sensitive information into call tasks or receptionist prompts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill exercises sensitive capabilities including shell execution, network access, local file reads/writes, and environment variable access, yet it declares no explicit permissions or capability boundary. This weakens reviewability and least-privilege controls, making it easier for the skill to access tokens, persist credentials, and place network-backed phone actions without clear governance.

Vague Triggers

Medium
Confidence
84% confidence
Finding
Broad trigger phrases like 'make a call' or 'call customer service' can cause the skill to activate in ambiguous contexts, increasing the chance of unintended invocation of a real-world telephony tool. Because this skill can initiate outbound calls and modify call-related state, accidental selection could lead to privacy issues, unwanted charges, or social-engineering amplification.

Session Persistence

Medium
Category
Rogue Agent
Content
envVars:
      - name: CLAW_TOKEN
        required: false
        description: ClawCall Agent bearer token; the register command can create and store one.
      - name: CLAW_TOKEN_FILE
        required: false
        description: Optional token file path; defaults to ~/.config/clawcall/token.
Confidence
90% confidence
Finding
The skill persists a bearer token locally and allows an override path via an environment variable, creating session persistence on disk. Even though the file mode is documented as 0600, locally stored long-lived authentication material increases exposure to token theft, misuse by other local processes under the same user, and accidental inclusion in backups or logs.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.