twilio-communications
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure credential management by utilizing environment variables (os.environ) for sensitive Twilio API keys and account identifiers.
- [SAFE]: Implementation of a request validator decorator ensures that incoming webhooks are authentic and originate from Twilio's infrastructure.
- [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection when constructing messages from external input.
- Ingestion points: The body parameter in TwilioSMS.send_sms and the Digits parameter in the IVR menu routes in SKILL.md.
- Boundary markers: No specific delimiters or boundary markers are utilized to encapsulate or label untrusted content.
- Capability inventory: The skill utilizes network-based capabilities to send SMS and manipulate voice calls via the Twilio REST API.
- Sanitization: While E.164 phone number validation is present via regex, the message body content is processed without sanitization or escaping.
Audit Metadata