pp-twilio

SUSPICIOUS. The skill’s Twilio-focused capabilities largely match its stated purpose, and the install sources appear same-publisher rather than obviously malicious. However, it asks the agent to install and trust a custom external CLI/MCP, uses unpinned latest-based installs, supports outbound webhook delivery of potentially sensitive Twilio data, and exposes high-impact Twilio actions through that binary. This is a coherent but higher-trust skill, best classified as medium risk rather than benign.