ClawHub
Back to skill

Security audit

Twilio Voice

Security checks across malware telemetry and agentic risk

Overview

This Twilio Voice skill transparently enables phone calls, recordings, transcripts, conferences, and DTMF control through AgentPMT, with no hidden local code or malware signal found.

Install only for agents that are allowed to use your Twilio account and business phone number. Before enabling recordings, transcripts, customer outreach, conference calls, signed recording downloads, or DTMF/PIN automation, confirm recipient consent, call-recording legality, account ownership, and retention/access rules for your organization.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill prominently enables call recording, transcription, and retention of call history without a clear requirement to verify consent, legal basis, or jurisdiction-specific recording rules. In a voice/call-management context, this creates meaningful privacy and compliance risk because an agent could record customers or third parties without proper notice or authorization.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill supports automatic customer calling, live external conversations, and DTMF/PIN entry into external phone systems, but it does not clearly require confirmation that the user is authorized to contact those parties or operate those systems. This can enable unintended actions on third-party systems, unauthorized outreach, or misuse of PIN-based phone workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.