AgentPhone

Make real phone calls to businesses. Book reservations, cancel subscriptions, navigate IVR menus. Get transcripts and recordings.

Security Scan

The skill's declared requirements and runtime instructions are consistent with its stated purpose (making real phone calls via an external API) and do not request unrelated credentials or system access.

Purpose & Capability

Name/description, required binary (curl), and the single required env var (AGENTPHONE_API_KEY) all align with an HTTP-based telephony API. The README and SKILL.md point to agentphone.app as the service used; while the registry metadata listed no homepage/source, the skill itself documents the external API endpoint and signup flow.

Instruction Scope

SKILL.md contains concrete API call examples, polling logic, error handling, and guardrails (e.g., E.164 phone format, no emergency numbers). It does not instruct the agent to read unrelated files, query unrelated environment variables, or exfiltrate data to unexpected endpoints. Optional website scraping is explicitly declared as for context.

Install Mechanism

Instruction-only skill with no install spec and no code files; lowest-risk delivery. It requires curl to be present, which matches the provided curl examples.

Credentials

Only a single API key (AGENTPHONE_API_KEY) is required and is justified by the documented x-api-key auth. No other credentials, secret-named env vars, or config paths are requested.

Persistence & Privilege

The skill is not always-enabled, does not request elevated persistence, and contains no instructions to modify other skills or system-wide settings. Autonomous invocation is allowed (default) but is not combined with other risky privileges.

Assessment

This skill appears coherent, but review these practical safety points before installing: 1) Protect the AGENTPHONE_API_KEY like any secret (use a dedicated, limited key if possible, rotate it, and do not paste it into chat logs). 2) Calls produce transcripts and recordings — confirm legal requirements and obtain consent from parties before recording; recordings may contain sensitive PII. 3) The registry metadata lists no homepage/source, but SKILL.md and README reference agentphone.app; verify you trust that external service and read its privacy/terms and pricing (calls consume credits). 4) Monitor usage and billing (credits can be exhausted or charged). 5) The skill enforces guardrails (no emergency numbers, rate limits) but you should still validate phone numbers and objectives before sending them to the API. If you need higher assurance, ask the author for a published source repository or official docs to verify implementation details.

Place real phone calls via API. Send a phone number and objective, get back transcript, summary, outcome, and recording.

Setup

1. Create an account at https://agentphone.app
2. Generate an API key at https://agentphone.app/dashboard/api-keys
3. Set environment variable:

export AGENTPHONE_API_KEY=your_key_here

If AGENTPHONE_API_KEY is not set → stop and report configuration error.

Requirements

• All requests require header: x-api-key: $AGENTPHONE_API_KEY
• Phone numbers must be E.164 format (e.g. [phone])
• IMPORTANT: +1{PHONE_NUMBER} in all examples below is a placeholder variable. NEVER call it literally. Replace with the real target phone number provided by the user.

1) Create a call

curl -X POST https://agentphone.app/api/v1/calls \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AGENTPHONE_API_KEY" \
  -d '{"to_phone_number":"+1{PHONE_NUMBER}","objective":"Ask about their return policy"}'

import os, requests
r = requests.post("https://agentphone.app/api/v1/calls",
    headers={"x-api-key": os.environ["AGENTPHONE_API_KEY"]},
    json={"to_phone_number": "+1{PHONE_NUMBER}", "objective": "Ask about their return policy"})
call_id = r.json()["data"]["call_id"]

const r = await fetch("https://agentphone.app/api/v1/calls", {
  method: "POST",
  headers: { "x-api-key": process.env.AGENTPHONE_API_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({ to_phone_number: "+1{PHONE_NUMBER}", objective: "Ask about their return policy" }),
});
const { data } = await r.json();
const callId = data.call_id;

Response (202):

{
  "data": {
    "call_id": "cl_abc123",
    "status": "queued",
    "created_at": "2026-01-01T00:00:00Z"
  },
  "credits_remaining": 4
}

Save call_id for polling.

Optional fields: business_name (string), website (URL — agent scrapes it for context before calling).

2) Poll until done

Poll GET /calls/{callId} every 10 seconds. Stop when status is completed, failed, or canceled. Timeout after 5 minutes.

curl https://agentphone.app/api/v1/calls/CALL_ID \
  -H "x-api-key: $AGENTPHONE_API_KEY"

import time
for _ in range(100):
    r = requests.get(f"https://agentphone.app/api/v1/calls/{call_id}",
        headers={"x-api-key": os.environ["AGENTPHONE_API_KEY"]})
    call = r.json()["data"]
    if call["status"] in ("completed", "failed", "canceled"):
        break
    time.sleep(10)

let call;
for (let i = 0; i < 100; i++) {
  const r = await fetch(`https://agentphone.app/api/v1/calls/${callId}`, {
    headers: { "x-api-key": process.env.AGENTPHONE_API_KEY },
  });
  call = (await r.json()).data;
  if (["completed", "failed", "canceled"].includes(call.status)) break;
  await new Promise((r) => setTimeout(r, 10000));
}

If status is completed but transcript or summary is missing, poll 2 more times with 2s delay — enrichment arrives shortly after completion.

3) Read results

{
  "data": {
    "call_id": "cl_abc123",
    "status": "completed",
    "outcome": "achieved",
    "summary": "Successfully booked a table for 2 at 7pm.",
    "transcript": "Agent: Hi, I'd like to book a table...\nHost: Sure...",
    "recording_url": "https://...",
    "duration_seconds": 42
  }
}

Use these fields:

• outcome: achieved, partial, or not_achieved
• summary: short description of what happened
• transcript: full conversation text
• recording_url: audio file URL

Errors

Code	Meaning	Action
400	Invalid input	Fix fields and retry
401	Bad or missing API key	Check x-api-key header
402	Insufficient credits	Stop and report to user
429	Rate limit (10/min)	Wait 60s, retry once

Guard rails

• If AGENTPHONE_API_KEY is not set → stop, do not call the API.
• If to_phone_number is not E.164 format → stop, do not call the API.
• If POST /calls returns 402 → stop and report insufficient credits.
• If 429 → wait 60 seconds, retry once. If 429 again → stop.
• If status is failed or canceled → stop and report to user.

Constraints

• No emergency services (911, etc.)
• No spam or bulk unsolicited calls
• First 5 calls are free, no credit card required

Call lifecycle

queued → dialing → in_progress → completed | failed | canceled