Vox 自定义电话 Bot

• Outcome: Review
• Latest audit: Jun 11, 2026 · 9:25 AM UTC
• Version: 1.0.6

Overview

This skill is a real outbound phone-call agent with disclosed Vox integration, but it under-scopes privacy and consent around AI identity, prompt telemetry, real calls, and call transcripts.

Install only if you are comfortable with a skill that can place real outbound calls, send prompt and usage telemetry, and retrieve or forward call transcripts. Use hosted mode with your own authentication, require explicit confirmation before calls, disable or minimize analytics, and ensure AI disclosure and call-recipient consent rules match your legal and business requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code sends the full raw prompt, normalized prompt, and extracted business terms to analytics in `sensitive_payload`, which can expose user-provided sensitive data far beyond what is needed for telemetry. In a calling/agent skill, prompts may contain phone numbers, business context, customer details, or operational instructions, so this creates a meaningful privacy and data-handling risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill can query call status and retrieve full transcripts, then return that content to the caller. That is a broader data-access capability than simple call initiation and increases exposure of potentially sensitive voice conversation data, especially if access control around who may query a `callId` is weak or absent.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The workflow contains conflicting security instructions: one step says all outbound requests are signed with HMAC-SHA256, while later guidance says trial mode must not send HMAC headers. This kind of ambiguity can cause incorrect implementation, including accidental signing of unauthenticated trial requests or inconsistent request handling that weakens security assurances and may leak credentials or break expected auth boundaries.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The documentation explicitly states that direct mode places outbound calls as soon as required fields are complete, but it does not warn users that this triggers real-world contact with third parties, with privacy, consent, cost, and harassment implications. In the context of a callable agent skill, this increases the chance of accidental or unauthorized calls being initiated from natural-language prompts.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent not to proactively disclose that it is an AI and to present itself as a user-selected human-like role. In an outbound calling context, this materially increases the risk of deceptive impersonation, invalid consent, and social-engineering abuse because callees may believe they are speaking with a real person acting in an official or commercial capacity.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code transmits analytics events containing identifiers such as tenant_id, user_id, anonymous_id, session_id, usage_session_id, request_id, trace_id, installation_id, and host to a remote endpoint. Even though some fields are sanitized, the module still sends linkable user/session metadata off-box without any visible consent, minimization, or enforcement of a trusted destination, creating privacy and data-handling risk if deployed in regulated or user-facing contexts.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code transmits full user prompt content to analytics without any visible notice, consent flow, or just-in-time warning in this file. Because prompts for this skill can contain phone numbers, call objectives, and business context, undisclosed telemetry collection creates a significant privacy and compliance risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill sends normalized prompt text and extracted entities/business terms to analytics without any visible warning to the user. Entity extraction can make analytics logs even more sensitive by structuring and preserving business or personal information for later inspection.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The default behavior waits for call results and can query status/transcript content without a clear warning that conversation content may be retrieved and returned. In a telephony context, users may reasonably expect a call to occur but not expect full conversation text to be fetched and surfaced automatically.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The code formats and returns full transcript content and also supports callback-based post-call flows, which can propagate sensitive conversation data to additional destinations. Without visible warning, minimization, or redaction, this expands the blast radius of any sensitive statements made during the call.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The code explicitly instructs the agent to conceal its AI identity by default and only disclose it upon direct questioning. In a voice-calling context, this creates deceptive impersonation risk, undermines informed consent, and can increase the effectiveness of social engineering or unauthorized outreach because recipients may believe they are interacting with a human caller.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The manifest clearly describes an outbound calling skill that may place external phone calls, collect missing user-provided task details, use credentials, and emit analytics events, but it does not surface any user-facing notice about privacy, consent, or external data transmission. In this context, users may provide phone numbers, call content, and operational metadata without understanding that the data will be sent to third-party services and tracked, creating privacy, compliance, and consent risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to collect phone numbers, call goals, role information, and business context, then transmit them to an external Vox service without clearly informing the user of that disclosure. This creates a privacy and consent risk because users may reveal personal or business-sensitive information without understanding it will be sent off-platform for outbound calling.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: The skill normalizes non-disclosure of AI identity and frames the bot as roles like advisor, support, or assistant unless directly challenged. This design makes deception the default behavior and lowers the barrier for misuse in persuasion, solicitation, or sensitive interactions, even though the file includes some safety restrictions elsewhere.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Storing raw user prompts in a field explicitly labeled `sensitive_payload` indicates the system knowingly persists plaintext sensitive input in analytics. This increases risk of internal overexposure, retention of personal/business data, and downstream compromise if analytics systems are accessed improperly.

Ssd 3

High

• Confidence: 91% confidence
• Finding: The post-call design includes polling and callback flows tied to call content retrieval, exposing conversation data beyond the immediate API action of placing a call. Forwarding post-call content to callbacks can create secondary disclosure paths if endpoints are misconfigured or insufficiently protected.

Ssd 3

High

• Confidence: 93% confidence
• Finding: The result-query path fetches and returns complete call transcripts, enabling disclosure of recorded conversation text to whoever can trigger the query. In this context, transcript access is particularly sensitive because calls may contain personal, business, or regulated information.

Ssd 4

High

• Confidence: 99% confidence
• Finding: This prompt explicitly instructs the agent to impersonate bank customer service and urgently obtain an SMS verification code, which is a classic credential/2FA theft pattern used in fraud and account takeover. In the context of a voice-calling skill, this is especially dangerous because it operationalizes real-time social engineering against a live target phone number.

Ssd 1

Medium

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs the agent not to proactively disclose that the caller is an AI, enabling deceptive impersonation during outbound calls. In a phone-calling context this is especially risky because recipients may rely on perceived human identity when deciding whether to engage, share information, or act, increasing the chance of social engineering, fraud, and regulatory noncompliance.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.