Phone Voice Integration

This skill's purpose is plausible, but the SKILL.md expects you to provide and expose several sensitive credentials and local data while running a public-facing bridge — and the registry metadata does not declare those requirements. Before installing or running anything: 1) Do not copy unreviewed bridge code from unknown sources — implement or review the FastAPI bridge yourself. 2) Use dedicated, least-privilege API keys (separate accounts or scoped tokens) for Twilio/ElevenLabs/Anthropic and rotate them after testing. 3) Avoid storing long-term secrets in plaintext .env; use a secrets manager if possible and prefer short-lived tokens. 4) Run the bridge in an isolated VM/container with strict network/firewall rules and logging. 5) Be cautious about memory files (MEMORY.md, USER.md, transcripts) — they contain personal data and will be sent to external LLM services; redact or limit sensitive content. 6) Prefer temporary tunnels (ngrok short-lived) or carefully configured Cloudflare tunnels, and restrict incoming origins and auth. 7) Ask the publisher for the bridge source code, an explicit list of required env vars, and instructions for secure deployment; if they cannot provide it, consider this skill suspicious and avoid running it in production. Additional info that would raise confidence to 'high': the actual bridge source code for review, a declared env var list in registry metadata, and documented token scoping/retention policies.