{
  "skill_name": "phone-agent",
  "skill_path": "/workspace/skills/clawhub-phone-agent",
  "skill_directory": "/workspace/skills/clawhub-phone-agent",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 6,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Manifest clearly lacks license field",
        "meta_exploitability": "N/A - Not a security issue",
        "meta_impact": "Low - Legal/licensing clarity"
      }
    },
    {
      "id": "llm_finding_phone-agent_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Hardcoded API Keys and Credentials in Source Code",
      "description": "The server.py script contains hardcoded Twilio phone number (+18665515246) and references to API keys that may be committed to version control. While environment variables are used for most credentials, the presence of hardcoded values and the pattern of credential handling creates risk of accidental exposure. The script also accesses multiple sensitive API keys (Deepgram, OpenAI, ElevenLabs, Brave, Twilio) which if logged or exposed could lead to unauthorized access.",
      "file_path": "scripts/server.py",
      "line_number": null,
      "snippet": "TWILIO_PHONE_NUMBER = os.getenv(\"TWILIO_PHONE_NUMBER\", \"+18665515246\")",
      "remediation": "Remove all hardcoded credentials and phone numbers. Use environment variables exclusively without defaults. Implement secrets management solution. Add .env to .gitignore. Audit all logging statements to ensure credentials are never logged.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This phone agent skill presents CRITICAL and HIGH security risks primarily related to credential management, network security, and resource consumption. The skill requires extensive external API access and handles sensitive voice data without sufficient safeguards. While the core functionality appears legitimate (building a voice AI phone agent), the implementation has significant security gaps: hardcoded credentials, unrestricted network access, missing input validation, unbounded resource usage, and incomplete disclosure of data flows. The skill should NOT be used in production without addressing the critical findings. The missing allowed-tools declaration and incomplete compatibility information make it difficult for users to assess risk. Recommended for experienced developers only, with significant security hardening required before deployment.",
        "primary_threats": [
          "Data Exfiltration/Credential Exposure",
          "Command Injection Risk",
          "Unrestricted Network Access",
          "Resource Exhaustion/DoS",
          "Insufficient Input Validation",
          "Incomplete Security Disclosure"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Hardcoded phone number is clearly visible in source code and represents a configuration value that should be externalized",
        "meta_exploitability": "Low - Requires access to source code and Twilio account credentials to exploit",
        "meta_impact": "Medium - Could lead to unexpected billing or exposure of internal phone numbers"
      }
    },
    {
      "id": "llm_finding_phone-agent_1",
      "rule_id": "LLM_COMMAND_INJECTION",
      "category": "command_injection",
      "severity": "HIGH",
      "title": "Command Injection Risk via Shebang with Hardcoded Virtual Environment Path",
      "description": "Both Python scripts use hardcoded shebang paths (#!/home/art/.local/venvs/phone-agent/bin/python3) that reference a specific user's home directory. This creates a security risk if the skill is distributed and executed on different systems, as it could execute arbitrary Python interpreters. The hardcoded path also reveals internal system structure and username information.",
      "file_path": "scripts/server.py",
      "line_number": null,
      "snippet": "#!/home/art/.local/venvs/phone-agent/bin/python3",
      "remediation": "Replace hardcoded shebang with portable version: #!/usr/bin/env python3. This allows the system to use the appropriate Python interpreter from PATH. Document virtual environment setup separately in README without hardcoding paths.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This phone agent skill presents CRITICAL and HIGH security risks primarily related to credential management, network security, and resource consumption. The skill requires extensive external API access and handles sensitive voice data without sufficient safeguards. While the core functionality appears legitimate (building a voice AI phone agent), the implementation has significant security gaps: hardcoded credentials, unrestricted network access, missing input validation, unbounded resource usage, and incomplete disclosure of data flows. The skill should NOT be used in production without addressing the critical findings. The missing allowed-tools declaration and incomplete compatibility information make it difficult for users to assess risk. Recommended for experienced developers only, with significant security hardening required before deployment.",
        "primary_threats": [
          "Data Exfiltration/Credential Exposure",
          "Command Injection Risk",
          "Unrestricted Network Access",
          "Resource Exhaustion/DoS",
          "Insufficient Input Validation",
          "Incomplete Security Disclosure"
        ],
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
        "scanner_category": "INJECTION ATTACK",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Hardcoded path is clearly visible and will cause portability issues",
        "meta_exploitability": "Very Low - Not directly exploitable, but reveals system information",
        "meta_impact": "Low - Portability issue, minor information disclosure"
      }
    },
    {
      "id": "llm_finding_phone-agent_3",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "HIGH",
      "title": "Unbounded Resource Consumption via WebSocket Connections",
      "description": "The server accepts unlimited WebSocket connections without rate limiting, connection limits, or timeout controls. The audio streaming loops run indefinitely without bounds checking. This creates risk of resource exhaustion and denial of service attacks. The server also lacks proper error handling for connection failures, which could lead to resource leaks.",
      "file_path": "scripts/server.py",
      "line_number": null,
      "snippet": "while True loops in handle_twilio_stream and handle_openai_stream without timeout or connection limits, no maximum connection count enforced",
      "remediation": "Implement connection limits (max concurrent connections). Add timeouts for idle connections. Implement rate limiting per IP/phone number. Add circuit breakers for external API failures. Implement proper cleanup in exception handlers. Add monitoring for resource usage.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This phone agent skill presents CRITICAL and HIGH security risks primarily related to credential management, network security, and resource consumption. The skill requires extensive external API access and handles sensitive voice data without sufficient safeguards. While the core functionality appears legitimate (building a voice AI phone agent), the implementation has significant security gaps: hardcoded credentials, unrestricted network access, missing input validation, unbounded resource usage, and incomplete disclosure of data flows. The skill should NOT be used in production without addressing the critical findings. The missing allowed-tools declaration and incomplete compatibility information make it difficult for users to assess risk. Recommended for experienced developers only, with significant security hardening required before deployment.",
        "primary_threats": [
          "Data Exfiltration/Credential Exposure",
          "Command Injection Risk",
          "Unrestricted Network Access",
          "Resource Exhaustion/DoS",
          "Insufficient Input Validation",
          "Incomplete Security Disclosure"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "No connection limiting code is present in the WebSocket handlers",
        "meta_exploitability": "Medium - Requires ability to open multiple connections to the public endpoint",
        "meta_impact": "Medium - Could cause service degradation or denial of service"
      }
    },
    {
      "id": "llm_finding_phone-agent_4",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Missing allowed-tools Declaration Creates Ambiguity",
      "description": "The skill manifest does not declare allowed-tools, making it unclear what agent capabilities are required or authorized. The skill requires network access, file system access (for .env files), and process execution (running FastAPI server), but these requirements are not explicitly declared. This creates ambiguity about the skill's intended permissions and makes it harder for users to assess risk.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "allowed-tools: Not specified",
      "remediation": "Add explicit allowed-tools declaration: [Bash, Python, Read]. Document that the skill requires network access and will start a local server. Add compatibility field specifying environment requirements (Linux/Mac, Python 3.8+, network access).",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This phone agent skill presents CRITICAL and HIGH security risks primarily related to credential management, network security, and resource consumption. The skill requires extensive external API access and handles sensitive voice data without sufficient safeguards. While the core functionality appears legitimate (building a voice AI phone agent), the implementation has significant security gaps: hardcoded credentials, unrestricted network access, missing input validation, unbounded resource usage, and incomplete disclosure of data flows. The skill should NOT be used in production without addressing the critical findings. The missing allowed-tools declaration and incomplete compatibility information make it difficult for users to assess risk. Recommended for experienced developers only, with significant security hardening required before deployment.",
        "primary_threats": [
          "Data Exfiltration/Credential Exposure",
          "Command Injection Risk",
          "Unrestricted Network Access",
          "Resource Exhaustion/DoS",
          "Insufficient Input Validation",
          "Incomplete Security Disclosure"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Manifest clearly lacks allowed-tools field",
        "meta_exploitability": "N/A - Not a security vulnerability, but a policy/documentation issue",
        "meta_impact": "Low - Makes it harder for users to assess required permissions"
      }
    },
    {
      "id": "llm_finding_phone-agent_5",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Incomplete Disclosure of External Dependencies and Data Flows",
      "description": "The skill description mentions Twilio, Deepgram, and ElevenLabs but does not disclose that it also uses Brave Search API and makes additional network calls. The description does not clearly warn users that their voice data, transcripts, and conversation content will be sent to multiple third-party services. This creates a social engineering risk where users may not fully understand the data sharing implications.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Description mentions 3 services but code uses 5+ external APIs (Twilio, Deepgram, OpenAI, ElevenLabs, Brave Search). No clear warning about data sharing with third parties.",
      "remediation": "Update description to list ALL external services used. Add explicit privacy warning about data sharing. Document data retention policies of third-party services. Provide opt-out mechanisms for optional features (like web search).",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This phone agent skill presents CRITICAL and HIGH security risks primarily related to credential management, network security, and resource consumption. The skill requires extensive external API access and handles sensitive voice data without sufficient safeguards. While the core functionality appears legitimate (building a voice AI phone agent), the implementation has significant security gaps: hardcoded credentials, unrestricted network access, missing input validation, unbounded resource usage, and incomplete disclosure of data flows. The skill should NOT be used in production without addressing the critical findings. The missing allowed-tools declaration and incomplete compatibility information make it difficult for users to assess risk. Recommended for experienced developers only, with significant security hardening required before deployment.",
        "primary_threats": [
          "Data Exfiltration/Credential Exposure",
          "Command Injection Risk",
          "Unrestricted Network Access",
          "Resource Exhaustion/DoS",
          "Insufficient Input Validation",
          "Incomplete Security Disclosure"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Code clearly uses Brave API but description doesn't mention it",
        "meta_exploitability": "N/A - Documentation issue, not a security vulnerability",
        "meta_impact": "Low - Users may not be fully informed about data sharing"
      }
    }
  ],
  "scan_duration_seconds": 63.96838617324829,
  "duration_ms": 63968,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T06:20:57.432947"
}