Telnyx Intelligence Provider

PassAudited by ClawScan on May 12, 2026.

Overview

This appears to be a straightforward Telnyx model-provider plugin that uses a Telnyx API key and sends chat requests to Telnyx, with no hidden or unrelated behavior found.

Install this if you intend to use Telnyx as an OpenClaw model provider. Be prepared to provide a Telnyx API key, understand that prompts sent through Telnyx models go to Telnyx, and note that the registry summary does not list the key requirement even though the package docs do.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Model requests may be made under your Telnyx account and could affect usage limits or billing.

Why it was flagged

The plugin uses a Telnyx API key for provider authentication. This is expected for the stated integration, but it is still an account credential.

Skill content

envVar: "TELNYX_API_KEY", promptMessage: "Enter your Telnyx API key", profileId: "telnyx:default"

Recommendation

Use a dedicated Telnyx API key where possible, keep it out of shared files and logs, and revoke it if you stop using the plugin.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any content you send through a Telnyx model will be processed by Telnyx's AI service.

Why it was flagged

Chat prompts and completion requests are sent to Telnyx as the core function of the provider. This data flow is disclosed and purpose-aligned.

Skill content

Routes OpenAI-compatible chat completion requests directly to the Telnyx AI Inference API

Recommendation

Review Telnyx's data-handling terms and avoid sending sensitive information unless your organization permits it.

Info

#ASI09: Human-Agent Trust Exploitation

What this means

A user relying only on the registry summary might miss that a Telnyx API key is needed.

Why it was flagged

The registry summary under-declares the credential requirement, even though SKILL.md, openclaw.plugin.json, and the code disclose TELNYX_API_KEY. This looks like a metadata gap rather than hidden behavior.

Skill content

Required env vars: none ... Primary credential: none

Recommendation

Read the package documentation before installation; the publisher should align registry metadata with the TELNYX_API_KEY requirement.