Twilio Setup

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

**Auth Token** is a secret. Collect it securely via `assistant credentials prompt` -- never accept it pasted in plaintext chat.

## Step 2: Collect and Store Credentials

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/twilio-setupThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Configure Twilio credentials and phone numbers for voice calls

---
name: twilio-setup
description: Configure Twilio credentials and phone numbers for voice calls
compatibility: "Designed for Vellum personal assistants"
metadata:
  icon: assets/icon.svg
  emoji: "📱"
  vellum:
    category: "integrations"
    display-name: "Twilio Setup"
    includes: ["public-ingress"]
---

You are helping your user configure Twilio for voice calls. Walk through each step below.

## Value Classification

Before you begin, understand how each Twilio value is stored:

| Value        | Type       | Storage method                                                     | Secret? |
| ------------ | ---------- | ------------------------------------------------------------------ | ------- |
| Account SID  | Config     | `assistant config set twilio.accountSid`                           | No      |
| Auth Token   | Credential | `assistant credentials prompt --service twilio --field auth_token` | **Yes** |
| Phone Number | Config     | `assistant config set twilio.phoneNumber`                          | No      |

- **Config values** (Account SID, Phone Number) are non-sensitive identifiers. Collect them via normal conversation -- the user can paste them in chat or you can use `AskUserQuestion`.
  **Auth Token** is a secret. Collect it securely via `assistant credentials prompt` -- never accept it pasted in plaintext chat.

## Retrieving Twilio Credentials

Many steps below require the Account SID and Auth Token. Retrieve them with:

```bash
TWILIO_SID=$(assistant config get twilio.accountSid)
TWILIO_TOKEN=$(assistant credentials reveal --service twilio --field auth_token)
```

# Checking Current Configuration

You can determine whether Twilio has been fully set up by checking to see that all the following config and credential values have been set:

```bash
assistant config get twilio.accountSid
assistant credentials inspect --service twilio --field auth_token --json  # check "hasSecret" field
assistant config get twilio.phoneNumber
```

- If all three config values are non-empty -- Twilio is fully configured. Offer to show status or reconfigure.
- Otherwise, continue to the missing steps.
- If Account SID and Auth Token are already stored (even when you skip Step 2), give the Channel Trust Floors briefing before continuing unless you already gave it in this conversation.

# Twilio Setup Steps

Follow the steps below in order to fully configure Twilio in preparation to make phone calls.

## Step 1: Check Current Configuration

Mark setup as started before doing any read-only checks. This lets a managed gateway begin opening the Velay tunnel WebSocket immediately, so the public Twilio HTTP and WebSocket routes are warming up while the user finishes entering credentials and selecting a phone number:

```bash
assistant config set twilio.setupStarted true
assistant platform status --json
assistant gateway status --json
```

If `assistant platform status --json` reports an available platform assistant but `assistant gateway status --json` returns `{}` (no `tunnel` URL yet), continue with setup and check status again before configuring webhooks. Do not treat this as an ngrok setup problem unless the assistant is local/self-hosted without Velay.

Refer to "Checking Current Configuration" above to see the current state of the user's Twilio setup. If Twilio appears to be fully configured, offer to show status or reconfigure. If they are asking about inbound access or an unexpected first greeting, go to "Channel Trust Floors" and the matching Troubleshooting section. Otherwise, continue to the missing steps below.

## Step 2: Collect and Store Credentials

Tell the user: **"You'll need a Twilio account. Sign up at https://www.twilio.com/try-twilio -- it's free to start and includes trial credit."**

They need two values from the Twilio Console dashboard (https://console.twilio.com):

- **Account SID** -- visible on the dashboard, starts with `AC` (this is not a secret value and can be collected conversationally)
- **Auth Token** -- click "Show" to reveal (this is a secret value and should be collected securely)

### Collect Account SID

Ask the user for their Account SID. This is NOT a secret value, so the user should be encouraged to comfortable paste it into the chat directly. Once they have, store it as a config value:

```bash
assistant config set twilio.accountSid "<Account SID from user>"
```

### Collect Auth Token

Ask the user for their Auth Token. This IS a secret value, so the user should be prompted to enter the value securely. Do NOT ask them to provide it in the chat. Once they have, store it as a credential:

- Run (via the bash tool):

  ```bash
  assistant credentials prompt --service twilio --field auth_token \
    --label "Twilio Auth Token" --placeholder "your_auth_token" \
    --description "Enter your Auth Token from the Twilio Console dashboard (click 'Show' to reveal it)"
  ```

Confirm it has been stored successfully:

```bash
assistant credentials inspect --service twilio --field auth_token
```

If credentials are invalid, Twilio API calls in Step 3 will fail -- ask the user to re-enter.

Once both the Account SID and Auth Token are stored, tell the user how Phone access works before continuing. Do not skip this briefing, even if they already have a number.

> Connecting Twilio does not open the line to everyone. Phone starts on **Verified contacts**: you and people you have verified can talk. Anyone else who calls hears that I don't recognize the number, is asked for their name, and you get a request so you can decide.
>
> Change this any time on the **Channels** page: select **Phone**, then **Who can message**. The options are **No one**, **Only you**, **Verified contacts**, **Any contact**, and **Strangers** (anyone who dials can talk immediately).

See "Channel Trust Floors" below if they want more detail or want to change the floor.

## Step 3: Get a Phone Number

The assistant needs a phone number for voice calls. Three options:

### Option A: Use an Existi

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✕BLOCK D 69 / 100

   first audit · source 19bc86343b63

Questions about Twilio Setup

• github.com/vellum-ai/vellum-assistant/tree/main/skills/twilio-se — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology