openclaw-voice-call-realtime
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation process involves cloning code from a personal GitHub repository (github.com/TristanBrotherton/openclaw-voice-call-realtime) and running npm install, which presents a supply chain risk from a source not recognized as a trusted vendor.
- [PERSISTENCE]: The skill instructions suggest configuring a Cloudflare Tunnel to run as a background service via systemd or macOS LaunchAgent, establishing a persistent network entry point that survives system restarts.
- [INDIRECT_PROMPT_INJECTION]: The agent is exposed to untrusted voice data during phone calls, which could be used to deliver malicious instructions. 1. Ingestion points: Real-time audio stream from third-party call participants (SKILL.md). 2. Boundary markers: The skill uses talking points to define goals but lacks explicit delimiters or instructions to ignore commands embedded in the audio stream. 3. Capability inventory: The agent can autonomously execute tools to press DTMF keys, report call outcomes, and terminate the connection (SKILL.md). 4. Sanitization: There is no evidence of transcript filtering or validation to prevent the agent from acting on malicious instructions received during the call.
Audit Metadata