agentphone

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to have the human "paste" their AgentPhone API key to the agent and to use that key in Authorization headers (e.g., "Authorization: Bearer YOUR_API_KEY") and curl commands, which requires the LLM to handle and embed secret API key values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill can ingest outsider-authored free text via inbound SMS/voice events delivered to the configured webhook (e.g., agent.message / agent.call_ended transcripts), which the agent then includes in its LLM context for response generation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The .mcp.json config runs "npx -y agentphone-mcp@0.2.0" at runtime (fetching and executing remote code from the npm registry) and points the runtime to https://api.agentphone.to, so the skill relies on externally fetched code that will be executed and can control agent behavior.