ClawHub
Back to skill

Security audit

呼波特AI电话数字员工

Security checks for vulnerabilities and agentic risk

Overview

The skill’s phone-call and account workflows fit its stated purpose and provide clear user controls, with installation and data-sharing risks to consider.

Install only if you trust WhoBot’s CLI publisher; the default installer downloads the current npm release. Share only recordings, documents, and customer lists you are authorized to provide, and remove unnecessary sensitive information. Review privacy terms, calling targets, schedules, and charges before confirming.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

The upload workflow lacks a privacy warning for call recordings and business documents.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow encourages uploading real call recordings and business documents without requiring a privacy notice, authorization check, or removal of unnecessary sensitive information. These materials can contain customer identifiers, private conversations, and confidential commercial information, so processing them through the service could cause unauthorized disclosure or privacy-compliance issues. Uploads are legitimate for this skill, and it respects denied file access, but those safeguards do not establish permission to disclose information about call participants or other third parties.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes @whobot/cli'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command uses npx --yes @whobot/cli@latest, allowing a mutable npm release to execute with the host user's permissions without an npm confirmation prompt. A compromised publisher account or malicious new release could therefore compromise the agent's environment; this is a CLI supply-chain risk, not an MCP-server configuration issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes @whobot/cli'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The recovery procedure reuses the step-3 installation command with --reset-local, inheriting its mutable @latest dependency and resulting supply-chain exposure. Explicit consent before resetting local login state reduces the risk of unauthorized deletion, but does not establish the trustworthiness of the downloaded executable; this is another occurrence of the same underlying installation weakness.

Content

No source excerpt is available for this finding.

The invocation examples include generic troubleshooting and feedback requests without limiting them to Whobot.

Low
Category
Trigger Abuse
Confidence
88% confidence
Finding

The examples include “命令找不到怎么办？” (What if the command cannot be found?), “帮我看看为什么用不了。” (Help me see why it does not work), and “我要反馈问题。” (I want to report a problem). These phrases commonly apply to unrelated products, and the section does not explicitly require Whobot context or exclude unrelated troubleshooting requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.