Elevenlabs Twilio Memory Bridge

• Outcome: Review
• Latest audit: Jun 2, 2026 at 1:25 AM UTC
• Version:
  1.1.1

Overview

The skill does what it claims, but its public webhook can run without authentication while returning stored caller context, so it should be reviewed before deployment.

Review before installing. Use WEBHOOK_SECRET in every non-local deployment, keep the service behind HTTPS, restrict network exposure where possible, set a strong ADMIN_API_KEY, and establish your own caller consent, retention, deletion, and access-control process for stored memories and notes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly promotes persistent storage of caller memory, session history, and notes tied to phone-derived identifiers, but it does not clearly require informed consent, legal basis, retention limits, or privacy disclosures. In a telephony context this increases privacy and compliance risk because sensitive caller data may be collected and reused across calls without users understanding or authorizing that behavior.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill states that it uses file-based persistence and stores caller memory, but it does not present a prominent user-facing warning that caller-derived data and contextual notes are retained in local JSON storage. In a telephony context, persisted caller memory can include sensitive behavioral or personal information, so insufficient disclosure can lead to privacy, consent, and compliance issues.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: If WEBHOOK_SECRET is unset, both webhook endpoints accept unsigned requests, allowing any external party who can reach the service to trigger personalization and post-call actions. In this skill, that is especially sensitive because unauthenticated requests can poison caller session state, create fraudulent call metadata, and influence prompt/context injection for future conversations.

VirusTotal

65/65 vendors flagged this skill as clean.