ClawAudit verdict

amber-voice-assistant

amber-phone-agent

🟠 Risky

Significant concerns — only install if you understand the risks

The skill manages real phone calls, stores call transcripts and a local CRM, reads/writes the operator calendar, and exposes MCP tools; the combination of inbound call audio processing, contact lookup, and optional outbound calling creates meaningful risk if misconfigured or abused.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

security

transparency

maintenance

Findings (11)

Pattern match high

Uses exec() — may execute shell commands

AMBER_SKILLS_SPEC.md · code · exec(

Pattern match high

HTTP request to bare IP address — common in malicious payloads

dashboard/README.md · code · http://127.0.0.1

Pattern match medium

References tunneling service

runtime/README.md · code · ngrok

Pattern match medium

References sudo — requests elevated privileges

README.md · prose · downgraded · sudo

Pattern match medium

Popular HTTP library — network access

AMBER_SKILLS_SPEC.md · code · Got

Pattern match medium

Opens WebSocket connection

ASTERISK-IMPLEMENTATION-PLAN.md · code · WebSocket

Pattern match medium

References child_process — can spawn system processes

runtime/src/index.ts · prose · downgraded · child_process

Pattern match medium

Dynamic import() — loads module at runtime

runtime/src/local-helper-runner.ts · prose · downgraded · import('

Pattern match low

Node http/https module — low-level network access

dashboard/scripts/serve.js · prose · downgraded · require('http')

Pattern match low

References webhook/callback URL

demo/demo-wizard.js · prose · downgraded · webhookUrl

Pattern match low

Accesses sensitive environment variables

runtime/src/providers/index.ts · prose · downgraded · process.env.TWILIO_AUTH_TOKEN

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class B). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

No declared permissions — minimal attack surface.

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API