Back to skill
Skillv1.0.0
ClawScan security
10dlc Registration · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 11, 2026, 9:41 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements, instructions, and included scripts are consistent with registering 10DLC via the Telnyx CLI and only ask for the Telnyx API key and CLI tooling they need.
- Guidance
- This skill appears to do only what it claims: it wraps Telnyx CLI commands to register 10DLC and requires a Telnyx API key and the Telnyx CLI. Before installing or running setup.sh: verify you trust the '@telnyx/api-cli' package and its source, be prepared that 'npm install -g' will modify your system/node environment, and never share your TELNYX_API_KEY with untrusted parties. The scripts prompt before making assignments; run test.sh to validate CLI/auth prior to doing real registrations.
Review Dimensions
- Purpose & Capability
- okName/description match the actual behavior: scripts and README use the Telnyx CLI and Telnyx API to create brands/campaigns and assign numbers. Required binary (telnyx) and required env var (TELNYX_API_KEY) are appropriate for the stated purpose.
- Instruction Scope
- okSKILL.md and scripts stay within the 10DLC registration domain: they call telnyx 10dlc commands, check auth, prompt the user before assignments, and provide troubleshooting. There are no instructions to read unrelated files, access unrelated credentials, or send data to endpoints outside Telnyx/documentation links.
- Install Mechanism
- noteThere is no package install spec in the registry metadata, but setup.sh installs the Telnyx CLI via 'npm install -g @telnyx/api-cli' if npm is available. Installing a global npm package modifies the system environment and requires privilege; this is expected for a CLI-based skill but users should verify the package origin/version before installing.
- Credentials
- okOnly TELNYX_API_KEY is required and declared as the primary credential. The scripts do not request unrelated secrets or other environment variables. telnyx auth setup will prompt interactively for credentials as expected.
- Persistence & Privilege
- noteSkill does not request always:true and is user-invocable. Setup modifies local state only by installing the Telnyx CLI (global npm install) and making included scripts executable (chmod). Those are reasonable for this functionality but are system-level changes the user should be aware of.