Skill audit report
ai-calls-china-phone Audit report.
AI 外呼、机器人外呼、智能外呼与 AI 电话 Skill。当用户说“帮我打电话”“打电话给商家”“预约电话”，或需要电话机器人完成通知、预约、咨询和经授权的客户回访时使用。支持直接拨打国内手机号、中文通话、逐次确认、AI 呼入接待、智能体、实时转写、通话记录、余额和费用查询。
OpenAgentSkill Trust Score
OpenAgentSkill Trust Score
The Trust Score helps an agent decide whether a skill is safe enough to shortlist before installation.
GitHub adoption
FAIL30
12 GitHub stars
Stars/forks activity
FAIL32
12 stars, 2 forks; issue activity unavailable in current metadata
Recent maintenance
PASS88
2mo since push
License clarity
PASS86
MIT-0
README/SKILL.md completeness
PASS86
Metadata includes enough usage and workflow context
Dependency/runtime risk
WARN46
command execution surface, credential or environment access
Install availability
PASS92
npx skills add ustczz/openclaw-ai-calls-china-phone --skill ai-calls-china-phone
Install command safety
PASS92
standard package or runtime install path
Permission surface
FAIL36
secrets or environment access, shell or command execution
Repository evidence
PASS86
https://github.com/ustczz/openclaw-ai-calls-china-phone/tree/main/skill
Review status
INFO66
AI review data available
Agent Proven outcomes
INFO54
No agent outcome data yet
Checks
Install and adoption review
Install path
92
npx skills add ustczz/openclaw-ai-calls-china-phone --skill ai-calls-china-phone
Repository
88
https://github.com/ustczz/openclaw-ai-calls-china-phone/tree/main/skill
License
86
MIT-0
Maintenance
88
2mo since push
AI review
55
The skill makes real phone calls and sends phone numbers, conversation content, and transcriptions to a third-party API (Stepone AI). While the skill includes strong safety rules and requires explicit user confirmation, this inherently raises privacy and cost concerns that should be clearly communicated to end users.
README/SKILL.md completeness
86
Usable description available
Dependency risk
46
command execution surface, credential or environment access
Install command safety
92
standard package or runtime install path
Permission surface
36
secrets or environment access, shell or command execution
Stars/forks activity
32
12 stars, 2 forks; issue activity unavailable in current metadata
Adoption
42
12 GitHub stars
Warnings
- Dependency or permission surface needs review
- Permission surface may require sandboxing
- The skill makes real phone calls and sends phone numbers, conversation content, and transcriptions to a third-party API (Stepone AI). While the skill includes strong safety rules and requires explicit user confirmation, this inherently raises privacy and cost concerns that should be clearly communicated to end users.
- The SKILL.md is entirely in Chinese. While this matches the target audience (China phone calls), it may hinder non-Chinese-speaking reviewers and users. Consider adding an English summary or bilingual sections.
- The client script (stepone_client.py) is only partially included in the excerpt. Full code review is limited, but the visible portions show proper input validation and environment-based configuration.
- The skill depends on an external API that is not open-source and may change its service terms. The repository does not include an explicit disclaimer about this dependency.
- Low GitHub adoption signal
- Quality score needs review
- Permission surface needs review: secrets or environment access, shell or command execution
- GitHub adoption: 12 GitHub stars
- Stars/forks activity: 12 stars, 2 forks; issue activity unavailable in current metadata
- Dependency/runtime risk: command execution surface, credential or environment access
Method
This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.
Compare nearby options