ClawHub
Back to skill

Security audit

PlaceCall

Security checks for vulnerabilities and agentic risk

Overview

This is a real phone-calling integration, but users should review it because it can place billable calls and has inconsistent API-key handling guidance.

Install only if you are comfortable letting an agent place real, recorded, potentially billable phone calls through PlaceCall. Keep the API key in OpenClaw config or an environment variable, not in chat, and confirm the target number, brief, callback number, and any personal details before a call is placed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (26)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 683)May include surrounding context.

md
- **Network refused / domain not allowed.** Agent sandboxes allow no outbound
  hosts by default. On Claude Code the user adds `api.voygr.tech` to
  `sandbox.network.allowedDomains` in `~/.claude/settings.json`; on a managed
  machine an admin may have to, because `strictAllowlist` and
  `allowManagedDomainsOnly` block instead of prompting.
- **Key missing and no shell to set it in** (desktop apps never see your shell).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 617)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 619)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 690)May include surrounding context.

md
Installing the skill needs no key. Placing calls does, and keys are self-serve.

1. Get a free key at https://api.voygr.tech/checkout?src=clawhub with your name
   and email. The key arrives by email.
2. Put it in this skill's `apiKey` slot in `~/.openclaw/openclaw.json`, or set
   `PLACECALL_API_KEY`. Never paste a key into a prompt.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill instructs the agent to source a local credential file and immediately use the loaded API key in an outbound request to a third-party service. Even though this is the intended integration, it creates a real secret-handling and external-transmission path: compromise of the remote service, misuse of the key, or accidental use without explicit user confirmation could result in unauthorized calls and spending.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
key**. Store it in the env var `PLACECALL_API_KEY`; NEVER print or echo the
  value — reference it as `$PLACECALL_API_KEY` in shell commands.
- **If `PLACECALL_API_KEY` is unset**, source `~/.codex/placecall.env` in the
  SAME shell command as the request: `. ~/.codex/placecall.env && curl ...`.
  An `export` in one command does NOT carry to the next, because each command
  runs in its own shell. If that file does not exist, tell the user to get a
  key at <https://api.voygr.tech/checkout?src=clawhub>. **Do NOT search the filesystem for

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This request sends the API key to the external service to retrieve account and quota information. While expected for the integration, it still establishes a credential-bearing outbound channel that could be abused or unexpectedly triggered by an agent without sufficient user awareness.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

Quick check — who am I / how much quota:

sh
curl -s -H "X-API-Key: $PLACECALL_API_KEY" https://api.voygr.tech/users/me
# 200 {"customer_id":"...","quota_limit":...,"current_usage":...,
#      "credits_available":...,"credits_held":...,"max_concurrent_calls":...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This is the core action path that sends a credential-authenticated request to an external telephony API to place a real phone call using user-provided instructions. Because it can incur financial cost, disclose information to third parties, and cause real-world contact, misuse or prompt injection into the brief has higher-than-normal impact for an agent skill.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

it in the brief. The bot reads only the brief, so put every detail in it.

sh
curl -s -X POST https://api.voygr.tech/calls \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -H "X-Client-Surface: clawhub" \
  -H "X-Client-Agent: ${CLAUDECODE:+claude-code}${CURSOR_AGENT:+cursor}${CODEX_SANDBOX:+codex}${GEMINI_CLI:+gemini-cli}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Listing recent calls transmits the API key and retrieves call metadata from the provider. This is an authenticated external data access path; if invoked unexpectedly, it can reveal communication history and associated phone numbers to the agent context.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md
from a bot that already spoke to them, and charges for both calls.

1. **Do not retry yet.** List your recent calls:
   `curl -s "https://api.voygr.tech/calls?limit=20" -H "X-API-Key: $PLACECALL_API_KEY"`.
2. **Look for this call**: same `target_phone`, `created_at` within the last few
   minutes. If it is there, it is your call — take its `call_id` and follow it
   (poll loop below). Do not place another.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This duplicate finding covers the structured call-creation flow, which still transmits authenticated, potentially sensitive booking or inquiry details to the external provider. The context remains risky because the resulting action is real-world, billable, and may involve personal information.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

| cancellation | booking_id of an ACTIVE booking made through this API — no phone slot |

sh
curl -s -X POST https://api.voygr.tech/calls \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -H "X-Client-Surface: clawhub" \
  -H "X-Client-Agent: ${CLAUDECODE:+claude-code}${CURSOR_AGENT:+cursor}${CODEX_SANDBOX:+codex}${GEMINI_CLI:+gemini-cli}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This duplicate finding covers the structured call-creation flow, which still transmits authenticated, potentially sensitive booking or inquiry details to the external provider. The context remains risky because the resulting action is real-world, billable, and may involve personal information.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

| cancellation | booking_id of an ACTIVE booking made through this API — no phone slot |

sh
curl -s -X POST https://api.voygr.tech/calls \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -H "X-Client-Surface: clawhub" \
  -H "X-Client-Agent: ${CLAUDECODE:+claude-code}${CURSOR_AGENT:+cursor}${CODEX_SANDBOX:+codex}${GEMINI_CLI:+gemini-cli}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The suggest endpoint sends a user query, optional location, and callback phone number to an external service for vendor discovery. This can expose user intent and contact details to the provider, and in this skill's context it directly feeds later real-world calling actions.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

only; queries and output are English.

sh
curl -s -X POST https://api.voygr.tech/v1/places/suggest \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -d '{
        "query": "florist in Chicago with fresh peonies in stock today",

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This handoff takes provider-generated place data and turns it into a live outbound call request. The danger is amplified because the skill explicitly warns that generated fields such as call_brief should be treated as data, not instructions; blindly forwarding them could operationalize model mistakes or manipulative content into real-world calls.

Content

Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.

sh
# phone and brief come straight off the card you picked
curl -s -X POST https://api.voygr.tech/calls \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -H "X-Client-Surface: clawhub" \
  -H "X-Client-Agent: ${CLAUDECODE:+claude-code}${CURSOR_AGENT:+cursor}${CODEX_SANDBOX:+codex}${GEMINI_CLI:+gemini-cli}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Polling the external event stream transfers the API key and retrieves live call transcripts and mid-call prompts, which may contain sensitive or socially engineered content. This creates a channel through which untrusted third-party speech enters the agent context and can influence subsequent actions.

Content

Scanner excerpt · SKILL.md (reported line 463)May include surrounding context.

md
ID=<call_id>; LAST=0; STOP=$(($(date +%s)+120))
while [ "$(date +%s)" -lt "$STOP" ]; do
  OUT=$(curl -s --max-time 20 -H "X-API-Key: $PLACECALL_API_KEY" \
        "https://api.voygr.tech/calls/$ID/events?after_event_id=$LAST")
  [ -n "$OUT" ] && echo "$OUT"
  N=$(printf '%s' "$OUT" | sed -n 's/^id: //p' | tail -1); [ -n "$N" ] && LAST=$N
  printf '%s' "$OUT" | grep -q '^event: outcome'  && { echo "### OUTCOME — done ###"; break; }

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding covers the answer-submission path, which can relay sensitive information from the user back into a live external call. In a prompt-injection setting, the person on the phone could manipulate the workflow into requesting secrets or payments through the agent.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

Answer a mid-call question — POST /calls/{call_id}/answer

sh
curl -s -X POST https://api.voygr.tech/calls/$ID/answer \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -d '{"request_id":"<from the ask_user data>","answer":"<your answer, in the call language>"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding covers the answer-submission path, which can relay sensitive information from the user back into a live external call. In a prompt-injection setting, the person on the phone could manipulate the workflow into requesting secrets or payments through the agent.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

Answer a mid-call question — POST /calls/{call_id}/answer

sh
curl -s -X POST https://api.voygr.tech/calls/$ID/answer \
  -H "X-API-Key: $PLACECALL_API_KEY" -H "Content-Type: application/json" \
  -d '{"request_id":"<from the ask_user data>","answer":"<your answer, in the call language>"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Fetching final call results retrieves transcripts, summaries, and outcome details from the external provider into the agent context. Those transcripts contain third-party speech and may include sensitive personal information or misleading instructions, so automatic downstream use is risky.

Content

Scanner excerpt · SKILL.md (reported line 498)May include surrounding context.

outcome_summary, outcome_charge_cents, and transcript_full.

sh
curl -s -H "X-API-Key: $PLACECALL_API_KEY" https://api.voygr.tech/calls/$ID

⚠️ Don't stop at the status flip. If status just became completed but

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

Authenticated usage queries disclose account/billing state to the external provider and return potentially sensitive operational metadata to the agent. This is lower risk than call placement but still an external authenticated interaction that should not occur implicitly.

Content

Scanner excerpt · SKILL.md (reported line 601)May include surrounding context.

Credits & top-ups

sh
curl -s -H "X-API-Key: $PLACECALL_API_KEY" https://api.voygr.tech/v1/usage
# {"remaining":...,"quota_limit":...,"current_usage":...,"tier":...}

Two things bill, and both draw on one balance. Calls: a success_* outcome

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:21