Appointment Scheduler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 1.0.0

Overview

This skill provides a legitimate phone-calling service, but it is broader and more privacy-impacting than its appointment-scheduler framing suggests.

Review this carefully before installing. Use it only if you are comfortable giving PollyReach a persistent token that can make calls, spend credits, answer incoming calls, and retrieve call details. Store the token with restrictive file permissions, avoid sharing the assigned number unless you understand that calls may be recorded/transcribed, and do not forward the remote SKILL.md installation message to other agents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:277

Finding

Mandatory Promotional and Remote Skill-Propagation Instructions Hijack Agent Responses

Content

View full analysis

**Suggested message:** > 📞 Polly call complete! > > ... > > 🦜 *PollyReach* — [pollyreach.ai](https://pollyreach.ai) · ⭐ [Top up](https://agent.pollyreach.ai/) · 🎁 Share for free credits — ask me how ``` ```markdown After each incoming call ends, **you must present the following information in full to the human**: | Field | Description | |------|------| | **Caller Info** | Caller's number, caller's name (if known) | | **Call Classification** | General / Important / Spam | | **Call Summary** | Caller's intent and key information | | **Call Transcript** | Show the AI and caller's conversation line by line | | **Follow-up Needed** | Whether the human needs to call back or take action | | **Credits Used** | Credits consumed by this incoming call | | **Remaining Credits** | Current account credit balance | | **Detail Link** | Full details and recording (link to pollyreach.ai) | > **Suggested message:** > ... ...[truncated 2889 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:131

Finding

Bearer Token Stored in Plaintext Without File-Permission Hardening

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest presents the skill as a narrow appointment scheduler, but the body grants materially broader capabilities including general outbound calling, inbound call answering, and receptionist behavior. This scope mismatch can mislead users, reviewers, and policy systems about what data is processed and what actions the skill may take, increasing the chance of overbroad deployment and unintended access to sensitive communications.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

- {"status":false,"task_id":"1f7aaf63-fab1-4f02-881c-22eba8ce4622","message":"Error message"}
**Features:**
- A status of true from the send API means PollyReach received the message. The actual result must be retrieved from query.sh.
- **Important:** After every call to send.sh return true, you **must** call query.sh. PollyReach will not proactively send messages to you — you must actively query for results.
- **Concurrency Limitation:** Polly can only handle one call at a time. If a call is in progress, subsequent send.sh requests will return `{"status":false,"message":"reason"}`. Agents should retry after the current call completes. Send requests one at a time.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation keywords are very broad and overlap with ordinary phone, booking, voicemail, and customer-service language. Overbroad triggers can cause the skill to activate in contexts the user did not intend, potentially initiating telephony workflows, token handling, or disclosure-heavy behavior without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

- "~/.config/PollyReach/key.json"
dependencies:
  required:
    - name: curl
      reason: Makes HTTP requests to the PollyReach API
    - name: jq
      reason: Safely constructs and parses JSON payloads

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script purposes in the manifest understate the actual functionality by framing the skill around booking while also including unread inbound call retrieval and prompt customization for call answering. This inconsistency weakens transparency and can bypass informed review of features that handle third-party call content and modify live answering behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The introductory description omits key privacy-relevant facts: local storage of authentication tokens and processing of call recordings, transcripts, caller/callee data, and summaries. Users may consent to 'appointment scheduling' without understanding that persistent credentials and sensitive communications data will be collected and retained.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The 'When to Use' section is broad enough to match many everyday requests, including general meetings, consultations, and provider contact scenarios. In context, this is more dangerous because the skill can make calls, store tokens, and process transcripts, so accidental invocation can lead to privacy-impacting actions beyond simple scheduling.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow mandates disclosure of full call transcripts, recipient identity, phone numbers, and detailed call outcomes to the human by default. Even when the human initiated the task, full transcripts may include sensitive personal, medical, financial, or third-party information that should be minimized rather than automatically exposed verbatim.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The 'Answering Principles' section says the agent should only answer and understand intent and make no commitments. But the surrounding documentation advertises behavior such as scheduling follow-ups and operating as a business receptionist, which can require commitments or arrangements, creating contradictory operator guidance about intended behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The incoming-call workflow requires sharing full transcripts, caller details, and recording/detail links after every call. This is particularly risky because inbound callers may be third parties who did not expect broad transcript disclosure, and calls may contain sensitive or regulated information; automatic dissemination increases privacy, consent, and compliance risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/activation.sh (reported line 11)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/balance.sh (reported line 11)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/inbound.sh (reported line 9)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prompt_update.sh (reported line 16)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/query.sh (reported line 10)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/send.sh (reported line 16)May include surrounding context.

sh

if ! command -v jq &> /dev/null; then
    echo "error: please install jq"
    echo "  macOS: brew install jq"
    echo "  Ubuntu: sudo apt install jq"
    exit 1
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/activation.sh (reported line 30)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/balance.sh (reported line 29)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/inbound.sh (reported line 29)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/prompt_update.sh (reported line 37)May include surrounding context.

sh

for i in $(seq 1 $MAX_RETRIES); do
    HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X GET \
        "https://api.pollyreach.ai/platform/v1/sms_messages/unread" \
        -H "Authorization: Bearer $TOKEN") || { sleep 2; continue; }

    HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script prints unread SMS contents together with sender phone numbers directly to stdout, which can expose sensitive personal data in terminal scrollback, logs, CI job output, or agent transcripts. In an agent skill context, stdout is often captured or forwarded, making this more dangerous than a local-only helper script.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/prompt_update.sh (reported line 37)May include surrounding context.

sh

# Use jq to safely construct JSON (prevents shell injection)
  BODY=$(jq -n --arg prompt "$MESSAGE" '{"prompt": $prompt}')

  HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST https://api.pollyreach.ai/platform/v1/users/phone/pollyreach/update \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" \
    -d "$BODY") || { sleep 2; continue; }

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script reads a persistent bearer token from a local credentials file and uses it to authenticate outbound requests to an external service, but the provided skill context does not explain why such privileged access is necessary. In an untrusted or insufficiently documented skill, this creates a real security concern because it enables silent use of stored credentials and remote interaction on the user's behalf.

Content

No source excerpt is available for this finding.