Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for making real phone calls, but it can initiate real-world calls and collect transcripts or recordings without requiring clear confirmation or privacy guidance.
Review before installing. Use this skill only when you want an agent to place real outbound calls on your behalf, and require the agent to confirm the target number, business, objective, and any account-changing request before it calls. Do not submit sensitive private URLs in the website field, and consider consent and recording/transcription rules for the call participants.
## 1) Create a call
```bash
curl -X POST https://agentphone.app/api/v1/calls \
-H "Content-Type: application/json" \
-H "x-api-key: $AGENTPHONE_API_KEY" \
-d '{"to_phone_number":"+1{PHONE_NUMBER}","objective":"Ask about their return policy"}'```python
import os, requests
r = requests.post("https://agentphone.app/api/v1/calls",
headers={"x-api-key": os.environ["AGENTPHONE_API_KEY"]},
json={"to_phone_number": "+1{PHONE_NUMBER}", "objective": "Ask about their return policy"})
call_id = r.json()["data"]["call_id"]```python
import os, requests
r = requests.post("https://agentphone.app/api/v1/calls",
headers={"x-api-key": os.environ["AGENTPHONE_API_KEY"]},
json={"to_phone_number": "+1{PHONE_NUMBER}", "objective": "Ask about their return policy"})
call_id = r.json()["data"]["call_id"]```
```javascript
const r = await fetch("https://agentphone.app/api/v1/calls", {
method: "POST",
headers: { "x-api-key": process.env.AGENTPHONE_API_KEY, "Content-Type": "application/json" },
body: JSON.stringify({ to_phone_number: "+1{PHONE_NUMBER}", objective: "Ask about their return policy" }),No suspicious patterns detected.