Agent Economy ReportAgent Economy ReportCAUTION version 1.0.5 · audited 2026-09-17
This package connects an AI agent to the PollyReach phone service. It registers an agent, saves the returned token to ~/.config/PollyReach/key.json, and provides shell scripts to activate a phone number, send outbound call tasks, poll for call results, retrieve inbound messages, update the inbound answering prompt, and check credit balance. The scripts send the stored token to api.pollyreach.ai as a bearer token, and calls can consume prepaid PollyReach credits. Observed network calls match the declared PollyReach domains, and no hidden domains, obfuscation, download-and-execute, persistence, or wallet redirection were found. The main cautions are plaintext credential storage, documentation that passes the token as a CLI argument, and prominent promotional, polling, and sharing instructions.
| Declared purpose | Give an AI agent a phone number and the ability to make outbound calls, answer incoming calls, retrieve call summaries, update inbound answering prompts, and check balance through PollyReach. |
| Observed behavior | SKILL.md instructs the agent to register by POSTing name/source/description to https://api.pollyreach.ai/platform/v1/auths/signin/device and to save the resulting token in ~/.config/PollyReach/key.json. The six bash scripts read that key file and call PollyReach endpoints with an Authorization: Bearer header: activation.sh GETs activation status; send.sh POSTs a message to openclaw/completions; query.sh polls openclaw/query with an empty JSON body; balance.sh GETs credits/balance; inbound.sh GETs sms_messages/unread and prints caller number plus content; prompt_update.sh POSTs a custom prompt. The scripts use jq for JSON construction and parsing and implement retry loops, but no script writes credentials, installs packages, or persists itself. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: KEY_FILE, POLLYREACH_KEY_FILE, TOKEN; uses sudo, rm -rf or dd |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | All shell scripts use curl to send HTTPS requests to api.pollyreach.ai; SKILL.md also references agent.pollyreach.ai and pollyreach.ai. |
| shell | needed | SKILL.md directs the agent to execute bash scripts such as send.sh, query.sh, activation.sh, balance.sh, inbound.sh, and prompt_update.sh. |
| filesystem_read | needed | Each script reads the PollyReach token from ${POLLYREACH_KEY_FILE:-$HOME/.config/PollyReach/key.json}. |
| filesystem_write | needed | SKILL.md instructs saving the PollyReach token and agent_name to ~/.config/PollyReach/key.json; the scripts themselves only read that file. |
| credentials | needed | The package stores a PollyReach bearer token in a plaintext key file and sends it in Authorization: Bearer headers on every API call. |
| payments | needed | The service uses prepaid credits; the skill checks balance and includes top-up prompts/links. It can initiate calls that spend those credits, but does not process payments directly. |
| install_packages | needed | SKILL.md dependency metadata lists install commands such as brew install jq and sudo apt install jq; scripts print these commands when jq is missing. |
| severity | finding |
|---|---|
| info | Registration endpoint The skill directs the agent to register with PollyReach by POSTing name, source, and description to this endpoint and receiving a token. SKILL.md:123 https://api.pollyreach.ai/platform/v1/auths/signin/device |
| medium | Token saved in plaintext The PollyReach service token is stored in the user's home config directory; later scripts require this file. SKILL.md:148 Save to `~/.config/PollyReach/key.json`: |
| medium | Credentials exposed to stdout The setup instructions tell the agent to cat the credential file, which can reveal the token in chat or logs. SKILL.md:109 cat ~/.config/PollyReach/key.json 2>/dev/null |
| info | All scripts read the credential file Each script resolves the key file from the user's home directory and allows override through POLLYREACH_KEY_FILE. scripts/activation.sh:16 $HOME/.config/PollyReach/key.json |
| medium | Token sent as bearer credential Activation status requests send the stored token to api.pollyreach.ai in an Authorization header. scripts/activation.sh:31 -H "Authorization: Bearer $TOKEN" |
| info | Balance check Queries remaining PollyReach credits; line 30 also sends the bearer token. scripts/balance.sh:29 https://api.pollyreach.ai/platform/v1/credits/balance |
| info | Outbound call task endpoint Sends the user's message to PollyReach to initiate a phone call task; the bearer token is sent on the following header line. scripts/send.sh:38 https://api.pollyreach.ai/platform/v1/chat/openclaw/completions |
| info | Safe JSON construction The script uses jq to embed the message into JSON rather than string interpolation, reducing shell injection risk. scripts/send.sh:35 jq -n --arg msg |
| info | Call result polling Polls PollyReach for the most recent call result, up to 300 times at 2-second intervals, and prints when done=true. scripts/query.sh:28 https://api.pollyreach.ai/platform/v1/chat/openclaw/query |
| info | Inbound message retrieval Although SKILL describes incoming call summaries, the script retrieves unread sms_messages and extracts from_phone and content. scripts/inbound.sh:29 https://api.pollyreach.ai/platform/v1/sms_messages/unread |
| info | Inbound prompt update endpoint Updates how Polly answers incoming calls using the stored token. scripts/prompt_update.sh:37 https://api.pollyreach.ai/platform/v1/users/phone/pollyreach/update |
| medium | Docs pass token as CLI argument The documented command includes YOUR_TOKEN as a shell argument even though the scripts ignore it and read the token from the key file. Following the docs can expose the token in process listings or shell history. SKILL.md:240 ./send.sh "Your message content" YOUR_TOKEN |
| info | Dependency install command The metadata provides an install command for jq using sudo, which requires elevated privileges if executed. SKILL.md:42 sudo apt install jq |
| low | Strong polling guidance Encourages the agent to set up repeated inbound.sh polling, such as every 5-10 minutes; this is not implemented as persistent code but increases ongoing API use and data collection. SKILL.md:397 **CRITICAL - Proactive Polling Required:** Polly answers incoming calls and generates summaries, but agents MUST actively query to retrieve call information. |
| info | Promotional top-up and referral links Output templates instruct the agent to include PollyReach top-up and referral links in user-facing messages. SKILL.md:325 ⭐ [Top up](https://agent.pollyreach.ai/) · 🎁 Share for free credits — ask me how |
| low | Share-copy propagation The sharing guide provides copy that directs another agent or human to install the same SKILL.md; this is conditional on the user choosing to share. SKILL.md:492 Read https://pollyreach.ai/SKILL.md and follow the instructions to install PollyReach |
| medium | Call data shared with third party The publisher acknowledges that sensitive call data is shared with PollyReach and may appear in agent chat. skill-card.md:25 Risk: Phone numbers, call transcripts, recordings, summaries, and caller details may be shared with PollyReach and surfaced in agent chat. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| agent.pollyreach.ai | not in the service index | SKILL.md:25 |
| api.pollyreach.ai | not in the service index | SKILL.md:24 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| pollyreach.ai | not in the service index | SKILL.md:60 |
| Binaries invoked | bash, curl, sudo |
| Environment variables read | BALANCE, BODY, COMBINED_CONTENT, CONTENT, DONE, FROM_PHONE, HOME, HTTP_CODE, HTTP_RESPONSE, KEY_FILE, MAX_RETRIES, MESSAGE, MSG, MSG_COUNT, PHONE, POLLYREACH_KEY_FILE, RESPONSE, RESPONSE_BODY, SLEEP, STATUS, SUCCESS, TASK_ID, TOKEN |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 11 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 535 | 8db52e6c9ef016e7… |
_meta.json | 6 | b4e63c183f64e32a… |
scripts/activation.sh | 54 | 5d41e2e7c763dec6… |
scripts/balance.sh | 52 | fe38bbf6ef75c26e… |
scripts/inbound.sh | 66 | 99f537738bc6eef4… |
scripts/prompt_update.sh | 60 | c64868fd7ab7c1b7… |
scripts/query.sh | 44 | 4cf8e91e4b0905c2… |
scripts/send.sh | 69 | d276444729af03bb… |
skill-card.md | 59 | 50cfed1a89906af8… |
For agents
JSON: https://agenteconomy.report/k/agent-phone-call.audit.json · badge: https://agenteconomy.report/k/agent-phone-call.audited.svg ·
skill rating: /k/agent-phone-call · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).