supercall
Enables AI-driven phone calls with custom personas using OpenAI and Twilio for seamless communication and automated navigation.
Install this skill
Security score
The supercall skill was audited on Feb 18, 2026 and we found 20 security issues across 3 threat categories, including 8 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Node child_process module reference
| 176 | When `tunnel.provider` is set to `ngrok`, the plugin spawns the `ngrok` CLI binary via `child_process.spawn`. When set to `tailscale-serve` or `tailscale-funnel`, it spawns the `tailscale` CLI instead |
Webhook reference - potential data exfiltration
| 154 | | `tunnel.provider` | Tunnel for webhooks (ngrok/tailscale-serve/tailscale-funnel) | none | |
Webhook reference - potential data exfiltration
| 163 | - ngrok or Tailscale for webhook tunneling (production) |
Webhook reference - potential data exfiltration
| 180 | - **Local webhook server**: The plugin opens an HTTP server (default `0.0.0.0:3335`) to receive Twilio webhook callbacks and WebSocket media streams. |
Webhook reference - potential data exfiltration
| 181 | - **Startup self-test**: On startup, the plugin sends an HTTP POST to its own public webhook URL with an `x-supercall-self-test` header to verify connectivity. If `publicUrl` is misconfigured to point |
Webhook reference - potential data exfiltration
| 184 | ### Webhook verification |
Ngrok tunnel reference
| 13 | "anyBins": ["ngrok", "tailscale"] |
Ngrok tunnel reference
| 56 | | `NGROK_AUTHTOKEN` | [ngrok](https://dashboard.ngrok.com) | ngrok tunnel auth (only needed if using ngrok as tunnel provider) | |
Ngrok tunnel reference
| 98 | "provider": "ngrok", |
Ngrok tunnel reference
| 99 | "ngrokDomain": "your-domain.ngrok.app" |
Ngrok tunnel reference
| 154 | | `tunnel.provider` | Tunnel for webhooks (ngrok/tailscale-serve/tailscale-funnel) | none | |
Ngrok tunnel reference
| 155 | | `tunnel.ngrokDomain` | Fixed ngrok domain (recommended for production) | - | |
Ngrok tunnel reference
| 156 | | `tunnel.ngrokAuthToken` | ngrok auth token | NGROK_AUTHTOKEN env | |
Ngrok tunnel reference
| 163 | - ngrok or Tailscale for webhook tunneling (production) |
Ngrok tunnel reference
| 176 | When `tunnel.provider` is set to `ngrok`, the plugin spawns the `ngrok` CLI binary via `child_process.spawn`. When set to `tailscale-serve` or `tailscale-funnel`, it spawns the `tailscale` CLI instead |
Ngrok tunnel reference
| 188 | - **ngrok free-tier relaxation**: On free-tier ngrok domains (`.ngrok-free.app`, `.ngrok.io`), URL reconstruction may vary due to ngrok's request rewriting; Twilio signature mismatches are logged but |
External URL reference
| 48 | | `OPENAI_API_KEY` | [OpenAI](https://platform.openai.com/api-keys) | Powers the realtime voice AI (GPT-4o) | |
External URL reference
| 49 | | `TWILIO_ACCOUNT_SID` | [Twilio Console](https://console.twilio.com) | Twilio account identifier | |
External URL reference
| 50 | | `TWILIO_AUTH_TOKEN` | [Twilio Console](https://console.twilio.com) | Twilio API authentication | |
External URL reference
| 56 | | `NGROK_AUTHTOKEN` | [ngrok](https://dashboard.ngrok.com) | ngrok tunnel auth (only needed if using ngrok as tunnel provider) | |