ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      batthis

      Safety Report

      Amber — Phone-Capable Voice Agent

      @batthis

      Give your OpenClaw agent real phone capabilities. Setup uses a short wizard; after setup, run calls and phone tasks with one natural-language prompt.

      2,736Downloads
      2Installs
      5Stars
      119Versions
      Project Management4,095Translation & i18n3,654Legal & Compliance2,019

      Security Analysis

      high confidence
      Suspicious0.08 risk

      Amber’s phone features are mostly disclosed, but it needs review because it automatically stores and reuses callers’ personal details without a built-in consent or retention gate.

      Jun 13, 202666 files5 concerns
      Purpose & Capabilityconcern

      Telephony, Twilio/OpenAI use, call logs, CRM, calendar access, message forwarding, and contacts lookup are broadly aligned with a phone-capable assistant and are disclosed in top-level metadata, but the runtime goes further by automatically creating CRM records and extracting personal context from transcripts after calls.

      Instruction Scopeconcern

      AGENT.md tells the assistant to silently save volunteered personal details and not ask permission, while runtime/src/index.ts performs post-call CRM extraction including personal context such as health issues, preferences, and life events. That creates under-scoped caller profiling despite later docs advising operator notice.

      Install Mechanismnote

      Install is a normal Node runtime install with pinned dependencies and a setup wizard that validates Twilio/OpenAI credentials against official endpoints and writes a local .env. It does require sensitive provider credentials and a native SQLite module.

      Credentialsnote

      Network access, webhooks, local logs, SQLite CRM, contact cache, and calendar helper use are proportionate for the stated phone-agent purpose. The dashboard server code is loopback-only, although one README example still mentions --host 0.0.0.0 and should be corrected.

      Persistence & Privilegeconcern

      The skill persists call transcripts/logs, message metadata, contact records, interaction history, optional Apple Contacts cache, and calendar events. Some write paths are confirmation-gated, but CRM persistence and transcript-derived enrichment are automatic and lack clear built-in opt-in, retention, or deletion controls.

      Guidance

      Install only if you are prepared to operate Amber as a sensitive communications system: disclose AI handling and logging to callers, configure a lawful consent/notice policy, review and delete CRM records regularly, restrict access to logs/transcripts/contact caches, and verify calendar writes through the MCP path before using it for production scheduling.

      Latest Release

      v5.5.35

      Harden security metadata, dashboard CORS, helper execution, calendar logging, CRM consent wording, contacts export defaults, and MIT-0 package licensing.

      More by @batthis

      Amber — Give Your Agent Real Phone Capabilities

      5 stars

      Phone Voice Assistant - Amber

      4 stars

      self-improving-agent

      @pskoett · 1,456 stars

      Gog

      @steipete · 672 stars

      Tavily Web Search

      @arun-8687 · 620 stars

      Find Skills

      @JimLiuxinghai · 529 stars

      Published by @batthis on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]