agentphone

BENIGN but high-impact. The skill is internally consistent with its stated purpose and routes data to official same-brand endpoints, with no suspicious installer or credential-harvesting behavior. Its primary risk is inherent capability: it empowers autonomous phone calls, messaging, OTP handling, billing-affecting actions, and optional forwarding of conversation data to arbitrary webhooks.

This configuration itself is not implementing malware, but it does create a significant supply-chain execution pathway by using npx (-y) to download and run an external npm package at runtime. AGENTPHONE_BASE_URL and AGENTPHONE_API_KEY are passed to that dependency, implying authenticated network activity. Risk depends entirely on the trustworthiness and integrity of agentphone-mcp@0.2.0 and its transitive dependencies; mitigate by pre-installing from a locked/integrity-pinned source and reviewing the dependency code/behavior.