voice-call

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents usage of the openclaw command-line tool to initiate voice calls and check call status. This is standard functionality for the voice-call plugin.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines tools that ingest untrusted message data which is subsequently processed for voice output.
  • Ingestion points: The message parameter in the initiate_call, continue_call, and speak_to_user actions (defined in SKILL.md).
  • Boundary markers: None present in the tool descriptions to delimit user-provided content.
  • Capability inventory: Uses the openclaw CLI to interface with external telephony providers (Twilio, Telnyx, Plivo).
  • Sanitization: No mention of content sanitization or safety filtering for the message payload prior to the call initiation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 09:14 PM
Security Audit — agent-trust-hub — voice-call