Security audit
SMS
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a coherent Twilio SMS/MMS plugin for OpenClaw, with expected credential, webhook, and messaging behavior and no hidden unrelated behavior found.
Install only if you intend to connect OpenClaw to a Twilio account. Protect the Twilio auth token, leave signature validation enabled outside local testing, prefer pairing or allowlist DM policy over open access, and expect SMS/MMS sends to contact real phone numbers and potentially incur Twilio charges. Verify package provenance if you rely on the @openclaw branding.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.