Security audit
Twilio WhatsApp Channel
Security checks for vulnerabilities and agentic risk
Overview
This plugin coherently implements a disclosed Twilio WhatsApp channel for OpenClaw, with expected credential, webhook, media, and messaging access for that purpose.
Install this only if you intend to connect OpenClaw to Twilio WhatsApp. Keep dmPolicy on allowlist unless the sender is intentionally public, use SecretRefs for Twilio tokens, confirm the public webhook URL is correct, and remember Twilio may bill for each message.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.