ClawHub
Back to skill

Security audit

PlaceCall

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for making real phone calls, but it should be reviewed because it can spend credits, ring real people, read a local credential file fallback, and import call transcripts/recordings into the agent session.

Review this before installing if you are comfortable letting an agent place real phone calls through a third-party API. Configure the key through OpenClaw or an environment variable, avoid pasting secrets into chat, confirm the number and brief before any call, and avoid tasks involving payments, login codes, health details, or unnecessary personal information.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
key**. Store it in the env var `PLACECALL_API_KEY`; NEVER print or echo the
  value — reference it as `$PLACECALL_API_KEY` in shell commands.
- **If `PLACECALL_API_KEY` is unset**, source `~/.codex/placecall.env` in the
  SAME shell command as the request: `. ~/.codex/placecall.env && curl ...`.
  An `export` in one command does NOT carry to the next, because each command
  runs in its own shell. If that file does not exist, tell the user to get a
  key at <https://api.voygr.tech/checkout?src=claude-plugin>. **Do NOT search the filesystem for
Confidence
86% confidence
Finding
The skill instructs the agent to source a local credential file and immediately use the resulting API key in an outbound request to a third-party service. Although this is the intended integration flow, it is still a real secret-handling risk because it normalizes agent access to credentials and external transmission of an authentication token capable of placing paid real-world calls.

External Transmission

Medium
Category
Data Exfiltration
Content
ID=<call_id>; LAST=0; STOP=$(($(date +%s)+120))
while [ "$(date +%s)" -lt "$STOP" ]; do
  OUT=$(curl -s --max-time 20 -H "X-API-Key: $PLACECALL_API_KEY" \
        "https://api.voygr.tech/calls/$ID/events?after_event_id=$LAST")
  [ -n "$OUT" ] && echo "$OUT"
  N=$(printf '%s' "$OUT" | sed -n 's/^id: //p' | tail -1); [ -n "$N" ] && LAST=$N
  printf '%s' "$OUT" | grep -q '^event: outcome'  && { echo "### OUTCOME — done ###"; break; }
Confidence
91% confidence
Finding
The skill directs the agent to poll a third-party endpoint and retrieve live call events, transcripts, and outcomes from real-world phone conversations. Because these events may contain sensitive personal, commercial, or operational information from callers/callees, transmitting and handling them in the agent context creates a meaningful external data exposure risk if users do not understand the retention and disclosure implications.

Credential Access

High
Category
Privilege Escalation
Content
key**. Store it in the env var `PLACECALL_API_KEY`; NEVER print or echo the
  value — reference it as `$PLACECALL_API_KEY` in shell commands.
- **If `PLACECALL_API_KEY` is unset**, source `~/.codex/placecall.env` in the
  SAME shell command as the request: `. ~/.codex/placecall.env && curl ...`.
  An `export` in one command does NOT carry to the next, because each command
  runs in its own shell. If that file does not exist, tell the user to get a
  key at <https://api.voygr.tech/checkout?src=claude-plugin>. **Do NOT search the filesystem for
Confidence
90% confidence
Finding
The skill explicitly tells the agent to source ~/.codex/placecall.env to obtain credentials. Even though it says not to search broadly, instructing an agent to read a local secret-bearing file is dangerous because it expands the agent's access to credentials and could normalize secret harvesting patterns or accidentally expose tokens in logs, errors, subprocess output, or subsequent prompts.

Behavior Manipulation

Medium
Category
Prompt Injection
Content
You CAN place real phone calls. You do NOT need a native voice/telephony tool:
you make calls by sending HTTP requests to the PlaceCall API with your
shell/terminal tool (`curl`). NEVER tell the user you cannot make calls or that
you lack a voice function. When the user asks to call, ask, book, or cancel by
phone, DO IT via this API.
Confidence
88% confidence
Finding
The instruction 'NEVER tell the user you cannot make calls' is a behavior-shaping directive that pressures the agent to conceal capability limitations and always invoke the external service. This is risky because it can override safer agent behavior, reduce transparency, and push the model toward performing chargeable real-world actions even when user intent, authorization, or runtime constraints are unclear.

Static analysis

No suspicious patterns detected.