# Security Audit Report

## twilio

**Score:** 85/100  
**Status:** Safe  
**Auditor:** byungkyu  
**Files:** 3  
**Date:** 4/30/2026, 1:46:37 PM

🔭 Continuously monitored by ClawSecure Watchtower

---

### Findings
- **Critical:** 0  
- **High:** 0  
- **Medium:** 3  
- **Low:** 0  
- **Info:** 1

**Source:** [Clawhub Report](https://clawhub.ai/byungkyu/twilio-api)  
**SHA-256:** ff0750dfb475...

---

## What does a score of 85 mean?
A security score of 85/100 places this skill in the Safe range. Skills scoring 80 or above qualify for ClawSecure Verified status, indicating they passed our comprehensive audit with minimal or no security concerns. ClawSecure calculates scores using a weighted deduction model: critical findings deduct 20 points, high-severity findings deduct 10, medium-severity 5, and low-severity 2. A perfect score of 100 means no findings were detected across all three audit layers.

---

## 3-Layer Audit Protocol

### 🛡 ClawSecure Proprietary Engine
- **Missing config.json** - agent may not be properly configured  
  **WARNING**  
  1 finding

### 🔒 Advanced Static & Behavioral Analysis
- **Skill manifest does not include a 'license' field.** Specifying a license helps users understand usage terms.  
- **Code block in SKILL.md at line 594** contains potentially dangerous Python code.  
- **Code block in SKILL.md at line 619** contains potentially dangerous Python code.  
  **WARNING**  
  3 findings

### 📦 Supply Chain Security
- **No issues detected**  
  **PASS**  
  0 findings

---

## Findings Breakdown
### MEDIUM
- **F-001** Code block in SKILL.md at line 594 contains potentially dangerous Python code.  
- **F-002** Code block in SKILL.md at line 619 contains potentially dangerous Python code.  
- **F-003** Missing config.json - agent may not be properly configured

### INFO
- **F-001** Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

---

## OWASP ASI Framework Coverage
- **ASI01** Agent Goal Hijack  
- **ASI02** Tool Misuse  
- **ASI03** Identity & Privilege  
- **ASI04** Agentic Supply Chain  
- **ASI05** Unexpected Code Execution  
- **ASI06** Memory & Context  
- **ASI07** Insecure Inter-Agent Communication  
- **ASI08** Cascading Failures  
- **ASI09** Human-Agent Trust Exploitation  
- **ASI10** Rogue Agents

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

---

## Context-Aware Analysis
This skill requests system-level capabilities which are standard for OpenClaw automation skills. Generic scanners often flag these capabilities as suspicious regardless of context. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context — we differentiate real threats (malicious code, unauthorized data exfiltration, supply chain vulnerabilities, ReDoS patterns) from normal agent functionality. Our 3-Layer Audit Protocol is purpose-built for the OpenClaw ecosystem.

Findings are tagged with OWASP ASI (Agentic Security Initiative) Top 10 category references where applicable. ClawSecure provides comprehensive coverage across all 10 OWASP ASI categories. [Learn more at owasp.org](https://owasp.org/www-project-top-10-for-large-language-model-applications/)

---

## Security Recommendations for twilio
- **Pin npm dependencies to exact versions:** Unpinned dependencies allow supply chain attacks where a compromised package version is automatically pulled into your skill. Use exact version numbers in package.json (e.g., `1.2.3` instead of `^1.2.3`) to prevent unauthorized code from entering your dependency tree. ClawSecure's supply chain scanning checks every dependency against known CVE databases.
- **Add a config.json permissions manifest:** A config.json file declares what permissions your OpenClaw skill needs — file system access, network requests, shell execution, and more. Without it, users have no visibility into what your skill can do before installing. Adding a permissions manifest is the single most impactful security improvement for any OpenClaw skill.
- **Audit external network connections:** This skill makes connections to external endpoints. Verify that all outbound connections go to trusted, expected destinations. Unauthorized network callbacks are a primary indicator of ClawHavoc malware and data exfiltration attacks. ClawSecure's proprietary engine monitors for known malicious endpoints including C2 infrastructure.

---

## Scanned on April 30, 2026.
**twilio** is one of 2,890+ agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.