Security Audit
twilio-communications
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
twilio-communications received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unvalidated status_callback URL in Twilio SMS.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unvalidated status_callback URL in Twilio SMS The `send_sms` function allows an arbitrary `status_callback` URL to be provided. If an attacker can control this parameter (e.g., via prompt injection to the LLM), they could direct the Twilio service to send delivery status updates to an attacker-controlled server. This can lead to data exfiltration (message SIDs, delivery status, and potentially sender/recipient information) and Server-Side Request Forgery (SSRF) against internal or external services. Implement strict validation for the `status_callback` URL. Consider an allow-list of trusted domains, or disallow external URLs if not strictly required. If external URLs are necessary, ensure robust validation to prevent SSRF (e.g., block internal IP ranges, non-standard ports, and suspicious domains). | LLM | SKILL.md:56 |
Scan History
Embed Code
[](https://skillshield.io/report/841bdd1a2b2700ce)
Powered by SkillShield