Twilio Comms

Twilio SMS, Voice, WhatsApp, and Verify (2FA) — send messages, make calls, and run verification flows from the CLI.

This package appears to implement a legitimate Twilio CLI, but take these precautions before installing or supplying credentials: - Confirm the source: the owner and homepage are unknown. Prefer packages from a known author or official repo. - Metadata mismatch: the registry did not declare required env vars even though SKILL.md and the script require TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, and TWILIO_FROM_NUMBER. Don't assume the registry listing is complete. - Limit exposure of credentials: use a Twilio API Key/Secret or a dedicated subaccount with minimal permissions and test credits, not your primary production account SID/token. Rotate keys after testing. - Review the script locally: the code is short and readable; inspect it yourself and run it in an isolated environment before providing real credentials. - Understand risk: these credentials can send messages and place calls (which can incur charges and leak information). Only provide them to trusted code and consider running on a machine/account with restricted network and billing limits. If the package maintainer/registry entry is updated to declare required env vars and provide a verifiable homepage or source repository, and you can verify the script contents match that source, the concerns would be reduced.

Type: OpenClaw Skill Name: twilio-comms Version: 1.0.0 The twilio-comms skill bundle is a standard CLI wrapper for the Twilio API, supporting SMS, Voice, WhatsApp, and 2FA verification. The Python script (scripts/twilio_comms.py) uses the requests library to interact with official Twilio endpoints (api.twilio.com and verify.twilio.com) and correctly handles credentials via environment variables without any evidence of malicious behavior or data exfiltration.