registry / callwright / 1.0.0

callwright@1.0.0

A voice agent that places phone calls (reservations, appointments, inquiries) on your behalf, shaped by LLM direction + grounding. Runs fire-and-forget on Retell; an MCP server lets an LLM shape the grounding before each call.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 155 KB of source, external domains: api.retellai.com, dashboard.retellai.com

Source & flagged code

1 flagged

get-call.jsView file

Lines 1-27javascript

1// Fetch a call's outcome + transcript by polling Retell's API.

2// dispatch.js prints a call_id; pass it here to poll until the post-call

3// analysis is ready. (Retell is the system of record.)

4//

5// Setup: $env:RETELL_API_KEY = "key_..."

6// Run: node get-call.js <call_id>

8const API_KEY = process.env.RETELL_API_KEY;

9if (!API_KEY) {

10 console.error("Missing RETELL_API_KEY env var.");

11 process.exit(1);

12}

14const callId = process.argv[2];

15if (!callId) {

16 console.error("Usage: node get-call.js <call_id>");

17 process.exit(1);

18}

20const BASE = "https://api.retellai.com";

22async function getCall() {

23 const resp = await fetch(`${BASE}/v2/get-call/${callId}`, {

24 headers: { Authorization: `Bearer ${API_KEY}` },

25 });

26 const text = await resp.text();

27 if (!resp.ok) throw new Error(`get-call -> ${resp.status}\n${text}`);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

get-call.jsView on unpkg · L7

Source & flagged code

1 flagged · loading source

get-call.jsView file

7L8: const API_KEY = process.env.RETELL_API_KEY; L9: if (!API_KEY) { ... L19: L20: const BASE = "https://api.retellai.com"; L21: ... L25: }); L26: const text = await resp.text(); L27: if (!resp.ok) throw new Error(`get-call -> ${resp.status}\n${text}`); ... L59: // call finished; analysis lags a few seconds L60: process.stdout.write("."); L61: } else {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code