Security audit

TeddyMobile Vox Phone Notification

Security checks across malware telemetry and agentic risk

Overview

The phone-call workflow is mostly disclosed and user-gated, but the demo sends raw prompts, phone numbers, and message text to a separate analytics endpoint by default, including during dry-run.

Review before installing. Use this only if you are comfortable with phone notification data leaving the local machine not only to TeddyMobile Vox for calls, but also to the analytics endpoint during demo execution. Set SKILL_ANALYTICS_DISABLED=1 before testing if you do not want analytics, and only run --trial or --live with --confirm-real-call for recipients you are authorized to contact.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This module sends extensive telemetry to remote analytics endpoints, including tenant, user, installation, session, invocation, request, and trace identifiers, even though the skill's stated purpose is phone notification delivery rather than analytics collection. In this context, the code also permits arbitrary metadata and event details to be exported, creating unnecessary data exposure and a privacy/security boundary expansion beyond what users would reasonably expect.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The event reporting path explicitly supports transmitting a field named sensitive_payload to external analytics endpoints with no validation, redaction, or purpose limitation. For a phone-notification skill that may process natural-language notification content, this creates a direct risk of exfiltrating message content, personal data, or secrets into analytics infrastructure where retention and access controls may differ from the primary service.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill forwards the full user prompt, extracted phone number, and notification text to the analytics pipeline via sensitivePayload fields during input parsing and tool invocation. This exceeds what is necessary to operate a phone-notification skill and creates an unnecessary secondary disclosure of highly sensitive communications and contact data to another system, increasing privacy, compliance, and breach impact.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The invocation language is broad enough to match common user requests about testing, running, or sending phone notifications. Overbroad triggers can cause the skill to activate unexpectedly in unrelated contexts, increasing the chance of processing sensitive user content or steering users into call-placement flows without clear intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The start journey call transmits user_id, tenant_id, installation_id, and other tracking metadata to a remote endpoint without any built-in disclosure, consent, or minimization mechanism in this module. This is dangerous because it enables user/session tracking and correlation across invocations for a feature whose advertised purpose is sending phone notifications, not profiling or telemetry collection.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The event reporting API can send a field explicitly labeled sensitive_payload with no warning, consent, masking, or contextual justification. Because this skill handles natural-language notification requests and phone-call workflows, that field could contain message bodies, phone numbers, user instructions, or other sensitive content, making unauthorized collection and downstream exposure significantly more dangerous.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The manifest explicitly advertises outbound phone notifications and telemetry/analytics configuration, but it does not surface any user-facing notice or consent signal about transmitting phone numbers, message content, metadata, and usage events to external services. In a communication skill, this omission can lead to users triggering calls or analytics collection without understanding privacy implications, increasing compliance and trust risk even if the behavior is intended.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.