Twilio Comms

Twilio SMS, Voice, WhatsApp, and Verify (2FA) — send messages, make calls, and run verification flows from the CLI.

Security Scan

The code and instructions implement a straightforward Twilio CLI, but registry metadata omits the required Twilio credentials and the package comes from an unknown source — review before use.

Purpose & Capability

The SKILL.md and included script implement the stated Twilio SMS/Voice/WhatsApp/Verify functionality. However the registry metadata lists no required environment variables or primary credential, while both SKILL.md and the script require TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN and TWILIO_FROM_NUMBER (and optionally TWILIO_VERIFY_SERVICE_SID). This metadata omission is an incoherence.

Instruction Scope

Runtime instructions and the script are narrowly scoped to calling Twilio APIs (api.twilio.com and verify.twilio.com) and formatting output. The script does not read arbitrary files, other credentials, or transmit data to third-party endpoints beyond Twilio. Commands and arguments are explicit.

Install Mechanism

There is no install spec (instruction-only usage) and the included code is a plain Python script that uses requests. No downloads from third-party URLs, no archive extraction, and no package managers are invoked — low installation risk. Note: the script will be executed from its path (scripts/twilio_comms.py).

Credentials

The script legitimately requires sensitive Twilio credentials (account SID and auth token) and a sender number, but the skill metadata does not declare these env vars or a primary credential. That mismatch is problematic because users may not realize they must provide secrets, and the owner is unknown. The number and type of env vars requested by the code are otherwise proportionate to the stated purpose.

Persistence & Privilege

The skill is not marked always:true, does not request persistence, and does not alter other skills or system-wide configuration. Model invocation is allowed (default) which is normal for user-invocable skills.

What to consider before installing

This package appears to implement a legitimate Twilio CLI, but take these precautions before installing or supplying credentials: - Confirm the source: the owner and homepage are unknown. Prefer packages from a known author or official repo. - Metadata mismatch: the registry did not declare required env vars even though SKILL.md and the script require TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, and TWILIO_FROM_NUMBER. Don't assume the registry listing is complete. - Limit exposure of credentials: use a Twilio API Key/Secret or a dedicated subaccount with minimal permissions and test credits, not your primary production account SID/token. Rotate keys after testing. - Review the script locally: the code is short and readable; inspect it yourself and run it in an isolated environment before providing real credentials. - Understand risk: these credentials can send messages and place calls (which can incur charges and leak information). Only provide them to trusted code and consider running on a machine/account with restricted network and billing limits. If the package maintainer/registry entry is updated to declare required env vars and provide a verifiable homepage or source repository, and you can verify the script contents match that source, the concerns would be reduced.

Automate SMS, voice calls, WhatsApp messaging, and two-factor authentication flows via the Twilio API. Send and track messages, place and monitor outbound calls, send WhatsApp templates or free-form messages, and run complete Verify 2FA flows — all from a single Python CLI tool.

Setup

export TWILIO_ACCOUNT_SID="ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export TWILIO_AUTH_TOKEN="your_auth_token_here"
export TWILIO_FROM_NUMBER="[phone]"        # your Twilio number
export TWILIO_VERIFY_SERVICE_SID="VAxx..."      # optional, for Verify/2FA

Get credentials: console.twilio.com → Account Info.

Commands / Usage

# ── SMS ─────────────────────────────────────────────────
# Send an SMS
python3 scripts/twilio_comms.py sms-send --to "[phone]" --body "Hello from Twilio!"
python3 scripts/twilio_comms.py sms-send --to "[phone]" --body "Custom sender" --from "[phone]"

# List recent messages
python3 scripts/twilio_comms.py sms-list
python3 scripts/twilio_comms.py sms-list --limit 50 --to "[phone]"

# Get delivery status of a message
python3 scripts/twilio_comms.py sms-status --sid "SMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# ── VOICE ───────────────────────────────────────────────
# Make an outbound call (plays TwiML message)
python3 scripts/twilio_comms.py call-make --to "[phone]" --message "Hello, this is an automated call."
python3 scripts/twilio_comms.py call-make --to "[phone]" --twiml-url "https://demo.twilio.com/docs/voice.xml"

# List recent calls
python3 scripts/twilio_comms.py call-list
python3 scripts/twilio_comms.py call-list --limit 25 --status completed

# Get call details and status
python3 scripts/twilio_comms.py call-status --sid "CAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Get call recordings
python3 scripts/twilio_comms.py call-recordings --call-sid "CAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# ── WHATSAPP ────────────────────────────────────────────
# Send a free-form WhatsApp message (within 24h session window)
python3 scripts/twilio_comms.py wa-send --to "[phone]" --body "Hi from WhatsApp via Twilio!"

# Send a template message (outside 24h window)
python3 scripts/twilio_comms.py wa-template --to "[phone]" --template "Your appointment is confirmed for {{1}}." --params "Monday 3pm"

# ── VERIFY / 2FA ────────────────────────────────────────
# Send a verification code (SMS or call)
python3 scripts/twilio_comms.py verify-send --to "[phone]"
python3 scripts/twilio_comms.py verify-send --to "[phone]" --channel voice

# Check/verify the code
python3 scripts/twilio_comms.py verify-check --to "[phone]" --code "123456"

Requirements

• Python 3.8+
• requests (pip install requests)
• Environment variables: TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, TWILIO_FROM_NUMBER
• Optional: TWILIO_VERIFY_SERVICE_SID for Verify/2FA commands