by 安全扫描
OpenClaw
安全
high confidence该技能的代码、指令和网络调用均符合一项代你拨打电话的服务特征；它会要求你用 Pine 进行身份验证（本地存储 token），并将通话参数发送至 Pine 的 API——整个包内没有任何内容试图执行无关或隐藏的操作。
评估建议
This skill appears to do what it says, but it requires you to: (1) Create/sign in to a Pine account and provide the verification code (the scripts store an access token at ~/.pine-voice/credentials.json). (2) Supply potentially sensitive callee_context (account numbers, payment info, authentication data) which will be transmitted to Pine's servers as part of the call. Before installing or using: verify the domain (19pine.ai) and the API endpoints you expect; decide whether you're comfortable tra...详细分析 ▾
✓ 用途与能力
Name/description (make phone calls, negotiate, return transcript) match the provided scripts and documented behavior. Required binary (node) and use of network APIs to 19pine.ai are proportional to the purpose; no unrelated credentials or binaries are requested.
ℹ 指令范围
SKILL.md instructs the agent to ask the user for their Pine AI account email, run the provided auth and call scripts, and collect potentially sensitive call context (account numbers, payment info, etc.). That is expected for a negotiation/agent-calling service but broad: the agent is explicitly told to collect all information the callee might need (including authentication/payment details), and to spawn background sessions while calls run. These instructions grant the skill permission to transmit sensitive personal and account data to Pine's API.
✓ 安装机制
No install spec; scripts are executed directly with node. No downloads or archive extraction. This is low-risk from an install perspective.
ℹ 凭证需求
No environment variables or external credentials are requested. The skill persists credentials to ~/.pine-voice/credentials.json (written with 0o600 permissions), which is proportional to the described auth flow. Be aware that saved access tokens permit the skill to call Pine's APIs on the user's behalf.
✓ 持久化与权限
always is false and the skill does not modify other skills or system-wide settings. It writes only its own credentials file in the user's home directory.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.22026/2/21
修复隐私政策链接。添加 auth-check.mjs 脚本。明确说明身份验证仅需一次。
● 无害
安装命令
点击复制官方npx clawhub@latest install pine-voice
镜像加速npx clawhub@latest install pine-voice --registry https://cn.longxiaskill.com
技能文档
通过 Pine AI 的语音 agent 拨打真实电话。agent 会拨指定号码、穿越 IVR、完成身份验证、进行谈判，并返回完整文字记录。
认证
凭据保存在~/.pine-voice/credentials.json——用户只需认证一次。
拨号前，先检查是否已认证：
``bash
node {baseDir}/scripts/auth-check.mjs
`
若返回 authenticated 为 true，直接跳到如何拨号。
若为 false，执行下方认证流程。
向用户索要其 Pine AI 账户邮箱（注册地址 https://19pine.ai）。 步骤 1：申请验证码
`bash
node {baseDir}/scripts/auth-request.mjs "user@example.com"
`
返回 {"request_token": "...", "email": "..."}。保存 request_token。
告知用户：
"验证码已发送至您的邮箱，请查收（包括垃圾邮件）并把验证码给我。" 步骤 2：验证并保存凭据
`bash
node {baseDir}/scripts/auth-verify.mjs "user@example.com" "REQUEST_TOKEN" "CODE"
`
返回 {"status": "authenticated", "credentials_path": "..."}。凭据自动保存。 何时使用
当用户想让你代打电话时使用。
注意：语音 agent 仅支持英语。
支持国家：美国/加拿大/波多黎各（+1）、英国（+44）、澳大利亚（+61）、新西兰（+64）、新加坡（+65）、爱尔兰（+353）、香港（+852）。 最适合
- 致电客服砍价、申请退款或解决问题
- 电话预约会议或到店时间
- 餐厅订位
- 致电商家询问服务或空位
- 代用户跟进联系人
如何拨号
步骤 1：收集全部必需信息
拨号前必须一次性收集对方可能需要的所有信息。通话中 agent无法向真人索要缺失信息。
预判所需：认证资料、付款信息、谈判目标、相关背景。 步骤 2：发起呼叫
通过 stdin 传入 JSON 参数：
`bash
node {baseDir}/scripts/call.mjs <<'EOF'
{
"dialed_number": "+14155551234",
"callee_name": "Comcast Customer Service",
"callee_context": "Cable and internet provider. Account holder: Jane Doe, account #12345.",
"call_objective": "Negotiate monthly bill down to $50/mo. Do not accept above $65/mo.",
"detailed_instructions": "Mention 10-year customer loyalty. If no reduction, ask for retention department.",
"caller": "negotiator",
"voice": "female",
"max_duration_minutes": 60,
"enable_summary": false
}
EOF
`
返回 {"call_id": "..."}。通话已启动。 步骤 3：轮询结果
每 30 秒查询一次，直到 is_terminal 为 true：
`bash
node {baseDir}/scripts/call-status.mjs "CALL_ID"
`
完成后响应包含 transcript、duration_seconds、credits_charged。
重要：用 sessions_spawn 在后台子 agent 运行，以便通话期间（5-60+ 分钟）你仍可响应用户。 示例任务：
使用 Pine Voice 脚本拨号。运行：node {baseDir}/scripts/call.mjs，stdin JSON：{"dialed_number": "+14155551234", "callee_name": "The Restaurant", "callee_context": "Italian restaurant, making a dinner reservation", "call_objective": "Reserve a table for 4 at 7pm tonight", "caller": "communicator"}。然后每 30 秒运行：node {baseDir}/scripts/call-status.mjs "CALL_ID" 直到 is_terminal 为 true。汇报完整记录与结果。
步骤 4：评估记录
不要只看 status 字段判断成败，必须阅读对方实际说了什么。
出现以下情况视为失败：
- 只有 Pine agent 在说话，对方全程沉默
- 对方为自动/录音应答（仅语音信箱或 IVR）
- 双方长时间静默
- 对方在目标未提及前挂断
通话参数
| 参数 | 必填 | 说明 |
|---|---|---|
| dialed_number | 是 | E.164 格式号码（如 +14155551234） |
| callee_name | 是 | 个人或商家名称 |
| callee_context | 是 | agent 需要的全部背景：身份、认证、验证信息 |
| call_objective | 是 | 具体目标及约束 |
| detailed_instructions | 否 | 策略、话术、行为指示 |
| caller | 否 | "negotiator"（默认）或 "communicator" |
| voice | 否 | "male" 或 "female"（默认 "female"） |
| max_duration_minutes | 否 | 1-120（默认 120） |
| enable_summa