CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · create-phone-number/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptcreate-phone-number/SKILL.md· markdown

15## Security and Source Rules

17- Never ask for carrier passwords, auth tokens, API keys, API secrets, or private keys in ch

… (3 chars elided on L17)

18- Use an existing Vapi `credentialId` for provider imports when the current public schema su

… (89 chars elided on L18)

19- If the public API requires raw carrier secrets and exposes no credential-based alternative

… (108 chars elided on L19)

Occurrences

1 occurrence · at L17

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

create-phone-number/SKILL.md · 1 file

create-phone-number/SKILL.md5.9 KB · Markdown

name: create-phone-number

description: Plan, provision, import, route, update, and verify Vapi phone numbers through the public API. Use for Vapi-hosted US PSTN numbers, explicitly requested SIP addresses, Twilio/Vonage/Telnyx or BYO carrier numbers, secure credential handling, assistant or squad routing, area-code requests, outbound limitations, and phone-provider troubleshooting.

license: MIT

compatibility: Internet access and VAPI_API_KEY are required only for live Vapi API operations.

metadata:

author: vapi

version: "2.0"

Vapi Phone Number Setup

Default to a payload or implementation plan. Provision, import, route, or release a number only when the user explicitly requests the live mutation. Require a final explicit confirmation immediately before provisioning or another potentially chargeable action.

Security and Source Rules

Never ask for carrier passwords, auth tokens, API keys, API secrets, or private keys in chat.
Use an existing Vapi credentialId for provider imports when the current public schema supports it. If a required credential does not exist, stop and state that API prerequisite.
If the public API requires raw carrier secrets and exposes no credential-based alternative, source them from local environment variables without displaying them, writing them to payload files, or logging the request body.
Verify provider fields against the current Create Phone Number API or public OpenAPI schema.
Never invent phone numbers, SIP realms, credentials, resource IDs, area-code availability, or routing destinations.

Procedure

Determine the execution mode.

Return a payload or plan when the user asks for a draft or does not clearly authorize a live mutation.
For a live request, confirm that VAPI_API_KEY is set without printing it.

Choose the transport path.

For a nontechnical request for an ordinary number, prefer the documented Vapi-hosted US PSTN path.
Use SIP only when the user explicitly asks for SIP. Require an exact supported SIP URI from the user or current public API documentation; if it is unavailable, stop and state the missing prerequisite. Do not invent a regional realm.
Use a carrier import only when the user owns the number and the required secure credential path is available.

Resolve routing before mutation.

List or get assistants and squads through public endpoints. Match a supplied name to one resource.
If several resources are plausible, ask the user to choose. Never guess an ID.
Route to either one assistantId or one squadId; clear conflicting destination fields when changing an existing route.

Check inventory safely.

Review existing phone numbers with GET /phone-number to avoid duplicate provisioning.
The current public OpenAPI accepts numberDesiredAreaCode but does not expose a public available-area-code inventory endpoint. Accept the user's desired three-digit US area code after explaining that fulfillment is not guaranteed.
Do not purchase a number merely to test availability. Do not infer global unavailability from one provisioning response.

Confirm and execute.

Show the provider, area code or exact owned number, routing destination, and whether the action may incur carrier or usage charges.
Obtain explicit confirmation immediately before POST /phone-number or another potentially chargeable mutation.
Validate the response for id, provider, number or SIP URI, status when present, and resolved route.

Update without destroying configuration.

GET /phone-number/{id} first.
Build the provider-specific update DTO. Change only requested writable fields and preserve the current provider, hooks, server, fallback destination, and provider-specific settings by omission or exact carry-forward as required by the public schema.
Do not send response-only fields such as id, timestamps, or organization metadata.
Re-fetch the number and verify the requested route or setting.

Handle failures precisely.

400: report the rejected field or unavailable request; correct a documented shape error before at most one retry.
401/403: stop for Vapi authentication or permission issues.
404: report the missing phone number, assistant, squad, or credential.
5xx: report a Vapi service failure and do not claim success.
Separate carrier-side ownership, credential, provisioning, or transport failures from Vapi routing configuration.

Free Vapi Number Limits

Vapi-hosted free numbers are for US national use and have a limit of five per account. The first free number can be requested without a payment method. Additional free numbers require a payment method on file, but the numbers themselves remain free.

Free Vapi numbers support outbound calls only to US +1 destinations and do not support international calling. Use an imported provider number or supported SIP/carrier path for international use. Do not describe free numbers as unlimited production telephony.

Payload-Only Example

This template does not provision anything:

{
  "provider": "vapi",
  "numberDesiredAreaCode": "<confirmed-three-digit-area-code>",
  "assistantId": "<verified-assistant-id>",
  "name": "Main Support Line"
}

Read Provider API Procedures for Vapi-hosted, Twilio, Vonage, Telnyx, BYO carrier, and routing examples. Read Phone Number API Examples when the user requests TypeScript, Python, or cURL implementation code. Keep placeholders out of live requests.

create-phone-number— agent skill

Is create-phone-number safe to install?

Vapi Phone Number Setup

Security and Source Rules

Procedure

Free Vapi Number Limits

Payload-Only Example

Public Sources

Audit the pieces. Scan the whole. Decide.