Security audit
Twilio WhatsApp Channel
Security checks across malware telemetry and agentic risk
Overview
This plugin appears to do what it claims: connect OpenClaw to WhatsApp through Twilio, with expected credential, webhook, and media-handling requirements.
Install only if you want an official Twilio WhatsApp Business channel and accept Twilio message costs. Keep dmPolicy on allowlist unless the sender is intentionally public, store auth tokens via OpenClaw SecretRefs rather than plaintext, and review media retention because inbound and staged outbound files are written to the OpenClaw state directory.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.