ClawHub
Back to skill

Security audit

keyue-call

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for Baidu AIOB outbound calling, but needs Review because it can trigger real phone calls and logs personal call details without a confirmation or redaction layer.

Install only if you intend to let the agent create Baidu AIOB outbound calls. Use dedicated low-privilege AIOB credentials, avoid passing secrets on the command line, restrict access to config and logs, and confirm recipient number/message before any call or scheduled call is created.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create_realtime_call.py:170
Finding

Credentials can be exposed through command-line arguments and plaintext configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create_realtime_call.py:208
Finding

Outbound-call personal data is unconditionally printed to standard output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/create_realtime_call.py:72
Finding

Full authentication error responses can leak access tokens into error logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs use of local configuration files and outbound API calls to Baidu AIOB, but it does not declare any explicit tool scope or permissions boundaries. That creates a real security governance gap: an agent may be able to read local files and make network requests without the user being clearly informed of or protected by least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill is designed to place outbound calls and transmit phone numbers plus message content to an external calling platform, yet the skill text does not present a clear user-facing warning or consent notice about third-party calling and data transfer. In this context, that omission is meaningful because the skill handles personal contact data and can contact third parties on the user's behalf, increasing privacy, compliance, and abuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation instructs the agent to create outbound calls and one-shot cron jobs via subprocess commands, but it does not require an explicit confirmation step, consent check, or user-facing warning before triggering real-world actions. In this skill context, that is risky because it can cause unintended phone calls or scheduled tasks based on ambiguous natural-language extraction, creating privacy, harassment, or operational-impact issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_realtime_call.py (reported line 68)May include surrounding context.

python
def get_access_token(access_key: str, secret_key: str, timeout: int = 15) -> str:
    payload = {"accessKey": access_key, "secretKey": secret_key}
    resp = requests.post(TOKEN_URL, json=payload, timeout=timeout)
    resp.raise_for_status()
    data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The script transmits phone numbers, dialog variables, and optional plaintext/ciphertext fields to a remote service to trigger real-world phone calls, but it applies no validation, consent enforcement, or destination restrictions. In a skill/agent environment, this can enable privacy-impacting data exfiltration and unauthorized outbound actions if upstream prompts or automation supply attacker-controlled inputs.

Content

Scanner excerpt · scripts/create_realtime_call.py (reported line 83)May include surrounding context.

python
"Content-Type": "application/json",
        "Authorization": access_token,
    }
    resp = requests.post(REALTIME_CALL_URL, headers=headers, json=body, timeout=timeout)
    resp.raise_for_status()
    return resp.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script can immediately place outbound calls using phone/contact data with no interactive confirmation, consent check, allowlist, or dry-run safeguard. In an agent-skill context, this makes accidental or unauthorized real-world actions more likely, especially if user input is mapped directly to call parameters or the skill is triggered automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill guidance, examples, and command semantics are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script reads accessKey and secretKey from config or CLI and immediately uses them to request an access token from a remote service. There is no comment, warning, or user-facing notice indicating that credentials from the local config will be transmitted for authentication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.