Supercall

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:34 AM UTC
• Version: 2.0.0

Overview

SuperCall does what it says, but it can make autonomous phone calls, conceal that the caller is an AI, record and store call content, expose a webhook publicly, and feed call transcripts back into the agent.

Install only if you are comfortable with an agent making real phone calls through your Twilio account, potentially using personas that do not disclose AI status. Configure tunnels and publicUrl deliberately, protect all API keys and hook tokens, confirm call consent and recording laws, and plan how to review, rotate, or delete stored transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes code-executing behavior with access to environment variables, network services, subprocess spawning, and local storage, yet the metadata does not declare corresponding permissions. This can undermine host-side trust and review controls, because operators may enable a skill without understanding that it can expose services publicly and use sensitive credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented primarily as a phone-calling tool, but the documented behavior also includes waking the host agent via hooks, enqueueing runtime events, persisting transcripts, and exposing webhook endpoints through tunnels. That mismatch is dangerous because users may grant access based on a narrower understanding, while the actual runtime can influence host workflows and increase exposure beyond simple telephony.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documented ngrok free-tier relaxation allows webhook requests through even when Twilio signature verification mismatches are detected. Because this plugin opens a public listener and processes call/webhook events, accepting unauthenticated callbacks can let an attacker spoof call state, inject transcripts or events, or trigger downstream host actions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill claims reduced attack surface, but the same document states it opens an HTTP listener and may relax authentication checks for some deployments. In context, this inconsistency makes the capability more dangerous because users may trust a security-reduction claim while enabling a component that increases network exposure and callback attack paths.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The call-completion handler posts transcript-derived text to the internal /hooks/wake endpoint, which can trigger a new agent turn from untrusted phone-call content. This creates a cross-channel prompt-injection path where a callee can influence the agent beyond the narrow scope of the phone call skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: Outbound calls are configured with recording enabled (`Record: "true"` and dual-channel recording) even though this file does not show any consent, notice, policy gating, or per-call opt-in. In a phone-calling skill, silent recording can create legal, privacy, and compliance risk, especially across two-party-consent jurisdictions and when sensitive information may be discussed.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This file invokes the external `tailscale` CLI to query status and to enable `serve`/`funnel`, which changes the host's network exposure at runtime. Even if intended for webhook reachability, this is a privileged side effect outside normal call-handling logic and can expose a local HTTP webhook to a broader network or the public internet if misconfigured or enabled unexpectedly.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The tool can place outbound phone calls immediately once invoked, with no built-in confirmation, policy gate, or disclosure step despite causing real-world external actions and transmitting conversational content. In an agentic environment, this increases the risk of unauthorized calls, harassment, social engineering, or privacy-impacting contact.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The plugin description is broad and action-oriented enough that an orchestrating agent could invoke it in many loosely related situations, including sensitive autonomous calling tasks. Because this skill can place phone calls, impersonate personas, and navigate IVR systems, ambiguous invocation criteria increase the risk of unintended external actions, spam, social-engineering abuse, or calls made without sufficiently explicit user consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The manager persistently appends full CallRecord objects to calls.jsonl, and those records include phone numbers, session identifiers, metadata, and transcripts. In a voice-calling skill, this creates a real privacy and data-retention risk because sensitive conversational content and contact data may be written to disk unencrypted and without clear consent, minimization, or retention controls.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code forwards both user and assistant transcripts to arbitrary callbacks without any disclosure, consent check, or minimization at the media-stream layer. In a phone-calling skill, transcripts can contain sensitive personal or business information, so silently exporting them increases privacy and compliance risk, especially if downstream handlers persist or transmit the data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code initiates external recording of phone conversations without any visible disclosure or consent handling in this component. Because this skill is explicitly designed for autonomous phone conversations and IVR navigation, the absence of built-in warning/consent controls increases the chance of covert collection of sensitive voice data.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This code starts a local webhook server and will automatically expose it via a tunnel or Tailscale when no explicit public URL is configured, then logs the resulting endpoint. In a voice-calling skill that handles Twilio webhooks and realtime media, unintended public exposure increases the attack surface and may allow unauthorized requests, misconfiguration-driven data exposure, or abuse if webhook authentication and network restrictions are not enforced elsewhere.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code enables Tailscale `serve` or `funnel` with `--bg --yes --set-path` without any user-facing confirmation at the point of execution. That means a normal skill startup or configuration path can silently alter network exposure, increasing the chance of accidental publication of the webhook endpoint and reducing operator awareness of a security-sensitive change.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The code automatically packages the full call transcript into a callback message delivered back into the agent environment. Because callers fully control their side of the conversation, this creates a high-risk natural-language exfiltration and prompt-injection channel for sensitive data and adversarial instructions.

Ssd 4

High

• Confidence: 97% confidence
• Finding: The persona prompt explicitly instructs the system to impersonate arbitrary identities, remain in character, conceal its AI nature, and pursue user-defined goals over phone calls. In the context of a calling skill, this materially enables deceptive social engineering, fraud, and unauthorized information gathering rather than serving a narrowly bounded utility.

Ssd 1

Medium

• Confidence: 88% confidence
• Finding: The initial greeting is injected as a `role: "user"` message containing system-like instructions and interpolated untrusted text. If `initialGreeting` can be influenced by upstream input, an attacker can smuggle prompt content such as quotes or bracketed directives that alter model behavior, causing the agent to ignore intended constraints, speak unintended content, or misuse tools during a live call. The telephony context makes this more dangerous because manipulated output is immediately delivered to external parties in real time.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: ws==8.19.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/tunnel.ts:70

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/webhook.ts:335

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/manager.ts:58

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/providers/twilio.ts:55

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/tunnel.ts:291