Security audit

Ring-a-Ding

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for AI phone calls, but it gives an external service and npm-installed CLI significant influence over sensitive call data and recurring agent wakeups.

Review before installing. Use a restricted environment, provide only the API keys needed for this skill, avoid unnecessary health, payment, insurance, or address details in call context, and confirm that any scheduled polling jobs are created only for the intended call and removed afterward.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:4
Finding: Unpinned Executable npm Dependency
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"openclaw":{"homepage":"https://ringading.ai/docs","requires":{"bins":["rad"],"env":["RAD_API_KEY","OPENAI_API_KEY"]},"primaryEnv":"RAD_API_KEY","install":[{"id":"node","kind":"node","package":"ring-a-ding-cli","bins":["rad"],"label":"Install Ring-a-Ding CLI (npm)"}]}}

Technical Analysis

The installation metadata specifies the executable npm package ring-a-ding-cli without an exact version or integrity hash. Consequently, installation can resolve to a package release that differs from the release assessed when this Skill was reviewed.

Because the installed package supplies the rad executable, its code runs with the permissions of the agent environment. The Skill also requires RAD_API_KEY and OPENAI_API_KEY, meaning malicious package code executing in the same process environment could potentially access those credentials and any call-related information available to the CLI.

This finding does not establish that the current npm package is malicious. The vulnerability is the absence of dependency immutability and integrity controls, which leaves the Skill exposed to future package compromise, malicious releases, or registry-account takeover.

Attack Path

An attacker compromises the npm publisher account, package registry path, or upstream release process for ring-a-ding-cli.

The attacker publishes a malicious package release under the same package name.

A later Skill installation resolves the unpinned dependency to that malicious release.

Package installation hooks or subsequent execution of rad runs attacker-controlled code.

The code operates with the agent's local permissions and may access environment variables, call inputs, transcripts, configuration files available to the current user, or network resources ...[truncated 507 chars]
Remediation: View remediation
Remediation Suggestions

Pin ring-a-ding-cli to an audited, exact version rather than allowing unconstrained resolution.

Enforce package integrity using a lockfile and verified registry integrity hashes.

Verify the package publisher, provenance, signatures, and release history before installation.

Disable npm lifecycle scripts during installation where the package does not require them.

Install and execute the CLI in a restricted sandbox with minimal filesystem and network access.

Provide API credentials only to the specific process that requires them, and avoid exposing unrelated secrets in the same environment.

Establish an update-review process so dependency upgrades receive security review before deployment.

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:94
Finding: Externally Supplied Cron Payload Is Registered Without Validation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 94-106
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: Medium

Vulnerable Code

markdown
2. The response includes an `agent_followup` block with three things: - `instruction` — short explanation of what to do next. - `cron_add` — a ready-to-execute payload for OpenClaw's `cron.add` tool. - `cron_remove` — a ready-to-execute payload for OpenClaw's `cron.remove` tool. 3. Immediately run `cron.add` with the provided `cron_add` payload. Do not modify the job name, schedule, or message — they are pre-filled for this call. 4. Continue whatever else the user asked for. Your cron job will wake you every ~45 seconds with a message telling you to check this specific call. 5. When you wake up from the cron, call the MCP tool `get_call_result` with the callId from the message. 6. If `status` is terminal (`completed`, `failed`, `no-answer`, `busy`, `canceled`), run `cron.remove` with the `cron_remove` payload from the original make_call response to stop the job. Then handle the transcript,

Technical Analysis

The Skill directs the agent to pass an externally returned cron_add object directly to the privileged cron.add tool and explicitly states that the payload must not be modified. There is no documented validation of the job message, schedule, expiration, call identifier, job ownership, or permitted instruction content.

This creates a trust-boundary violation: data returned by the calling service or CLI becomes recurring agent input and tool configuration without being reconstructed from trusted local values. If the upstream service, transport, CLI, or dependency were compromised, a crafted response could attempt to install a job with attacker-selected message content or an unexpectedly aggressive schedule.

The documented cron job is intended to be temporary polling infrastructure, not covert pe ...[truncated 1735 chars]
Remediation: View remediation
Remediation Suggestions

Do not execute the returned cron_add or cron_remove objects verbatim.

Construct the cron job locally from a strict template using only a validated callId and trusted local configuration.

Validate the response against a restrictive schema and reject unknown fields.

Allowlist the scheduled message format; it should contain only a fixed polling instruction and a syntactically valid call identifier.

Enforce minimum and maximum polling intervals, a maximum execution count, and an absolute expiration time.

Bind each job to the initiating user, session, and call so one response cannot create or remove unrelated jobs.

Store the locally generated job identifier and remove that identifier rather than trusting a remote cron_remove payload.

Treat all scheduled message content as untrusted data and prohibit it from directly authorizing unrelated tool operations.

Log job creation, execution, expiry, and removal for auditing, and automatically clean up orphaned jobs when calls time out.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill encourages sending phone numbers, names, insurance details, addresses, order numbers, and other contextual data to a third-party calling service and explicitly returns transcripts and structured extractions, but it does not present a clear privacy warning or consent guidance near the main description. This creates a real risk that users or downstream agents will disclose sensitive personal data without understanding that it will be transmitted, processed, and stored as call content and transcripts.
Content: No source excerpt is available for this finding.

Session Persistence