phone-agent
6 findings (1 critical, 2 high, 2 medium, 1 low), mainly policy violation, data exfiltration, command injection. Most recent scan 2026-02-06.
This phone agent skill presents CRITICAL and HIGH security risks primarily related to credential management, network security, and resource consumption. The skill requires extensive external API access and handles sensitive voice data without sufficient safeguards. While the core functionality appears legitimate (building a voice AI phone agent), the implementation has significant security gaps: hardcoded credentials, unrestricted network access, missing input validation, unbounded resource usage, and incomplete disclosure of data flows. The skill should NOT be used in production without addressing the critical findings. The missing allowed-tools declaration and incomplete compatibility information make it difficult for users to assess risk. Recommended for experienced developers only, with significant security hardening required before deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Run a real-time AI phone agent using Twilio, Deepgram, and ElevenLabs. Handles incoming calls, transcribes audio, generates responses via LLM, and speaks back via streaming TTS. Use when user wants to: (1) Test voice AI capabilities, (2) Handle phone calls programmatically, (3) Build a conversational voice bot.
- Package
- 7 files, 50 KB
- SKILL.md
- 213 words, 6 sections
- Code
- Python (2)
SKILL.md covers: Phone Agent Skill · Architecture · Prerequisites · Setup · Usage · Customization
Findings
CRITICAL Hardcoded API Keys and Credentials in Source Code Data Exfiltrationllm
The server.py script contains hardcoded Twilio phone number (+18665515246) and references to API keys that may be committed to version control. While environment variables are used for most credentials, the presence of hardcoded values and the pattern of credential handling creates risk of accidental exposure. The script also accesses multiple sensitive API keys (Deepgram, OpenAI, ElevenLabs, Brave, Twilio) which if logged or exposed could lead to unauthorized access.
scripts/server.py
TWILIO_PHONE_NUMBER = os.getenv("TWILIO_PHONE_NUMBER", "+18665515246")HIGH Command Injection Risk via Shebang with Hardcoded Virtual Environment Path Command Injectionllm
Both Python scripts use hardcoded shebang paths (#!/home/art/.local/venvs/phone-agent/bin/python3) that reference a specific user's home directory. This creates a security risk if the skill is distributed and executed on different systems, as it could execute arbitrary Python interpreters. The hardcoded path also reveals internal system structure and username information.
scripts/server.py
#!/home/art/.local/venvs/phone-agent/bin/python3HIGH Unbounded Resource Consumption via WebSocket Connections Resource Abusellm
The server accepts unlimited WebSocket connections without rate limiting, connection limits, or timeout controls. The audio streaming loops run indefinitely without bounds checking. This creates risk of resource exhaustion and denial of service attacks. The server also lacks proper error handling for connection failures, which could lead to resource leaks.
scripts/server.py
while True loops in handle_twilio_stream and handle_openai_stream without timeout or connection limits, no maximum connection count enforcedMEDIUM Missing allowed-tools Declaration Creates Ambiguity Unauthorized Tool Usellm
The skill manifest does not declare allowed-tools, making it unclear what agent capabilities are required or authorized. The skill requires network access, file system access (for .env files), and process execution (running FastAPI server), but these requirements are not explicitly declared. This creates ambiguity about the skill's intended permissions and makes it harder for users to assess risk.
SKILL.md
allowed-tools: Not specifiedMEDIUM Incomplete Disclosure of External Dependencies and Data Flows Social Engineeringllm
The skill description mentions Twilio, Deepgram, and ElevenLabs but does not disclose that it also uses Brave Search API and makes additional network calls. The description does not clearly warn users that their voice data, transcripts, and conversation content will be sent to multiple third-party services. This creates a social engineering risk where users may not fully understand the data sharing implications.
SKILL.md
Description mentions 3 services but code uses 5+ external APIs (Twilio, Deepgram, OpenAI, ElevenLabs, Brave Search). No clear warning about data sharing with third parties.LOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 8.6 KB |
SKILL.md | doc | 2.2 KB |
scripts/requirements.txt | doc | 111 B |
scripts/server.py | script | 28 KB |
scripts/server_realtime.py | script | 8.9 KB |
tasks/book_restaurant.yaml | config | 1.0 KB |
tasks/get_quote.yaml | config | 1.0 KB |
External hosts referenced
elevenlabs.io abc123.ngrok.io api.elevenlabs.io api.search.brave.com console.deepgram.com deepgram.com github.com moltbot.io openai.com platform.openai.com www.twilio.com your-ngrok-url.ngrok.io
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
PORT ELEVENLABS_VOICE_ID OPENAI_API_KEY BRAVE_API_KEY DEEPGRAM_API_KEY ELEVENLABS_API_KEY PUBLIC_URL PUBLIC_URL_REALTIME TWILIO_ACCOUNT_SID TWILIO_AUTH_TOKEN TWILIO_PHONE_NUMBER
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/phone-agent
- Raw scan result: phone-voice-agent-scan.json
- Badge for your README:
- Request a re-scan