# twilio-security-hardening

Hardens Twilio apps against credential leaks, toll fraud, and compliance risks under PCI DSS or HIPAA. Useful when building and deploying production telephony or messaging.

- skill · `type=skill` · Codex, ChatGPT · ★ 7604
- Author: Twilio · official OpenAI repository
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/openai/plugins/tree/HEAD/plugins/twilio-developer-kit/skills/twilio-security-hardening/SKILL.md
- Updated: 2026-10-08
- HTML: https://affpapa.org/en/nevibecode/skills/twilio-security-hardening

## What it does

The skill guides coding agents through hardening Twilio infrastructure against credential theft and spoofing. It enforces individual API keys over the master Auth Token for server environments. Rotating the primary Auth Token instantly revokes every active API key across the entire project. To prevent catastrophic outages, the guide insists on scoped keys and verifies incoming `X-Twilio-Signature` headers with the official SDK.

Compliance decisions also demand caution. Enabling account-wide PCI Mode is permanent. Once activated, you cannot disable it. The skill instructs you to isolate payment operations into dedicated sub-accounts, pause recording during card intake, or offload processing to the `<Pay>` verb. For healthcare builds bound by HIPAA, it covers BAA execution and patient data minimization in `<Say>` prompts.

To counter SMS pumping attacks, the skill configures layered defenses. It couples country-level geo-permissions with line-type intelligence lookups and strict verification rate limits.

## Install

### Codex (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add openai/plugins --skill twilio-security-hardening -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/twilio-security-hardening/SKILL.md` — For all projects use ~/.agents/skills/

### Claude Code

1. **Skills CLI (Vercel)**
```bash
npx skills add openai/plugins --skill twilio-security-hardening -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/twilio-security-hardening/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/twilio-security-hardening/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/twilio-security-hardening/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install openai/plugins twilio-security-hardening
```

2. **Manually: put the files in place**
- File: `.github/skills/twilio-security-hardening/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/openai/plugins --path plugins/twilio-developer-kit/skills/twilio-security-hardening
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/twilio-security-hardening/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/openai/plugins/tree/HEAD/plugins/twilio-developer-kit/skills/twilio-security-hardening/SKILL.md

## When to use it
- verify inbound webhooks via `X-Twilio-Signature` validation
- block toll fraud and SMS pumping using geo-permissions
- rotate API credentials with zero service downtime
- isolate cardholder data into sub-accounts for PCI DSS

## Example prompts
- Validate inbound Twilio webhooks in Node.js using request signatures.
- Set up SMS pumping prevention with geo-permissions and rate limits.
- Draft a zero-downtime rotation plan for Twilio API keys.

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: fbfbda524f1d14b8.

BEGIN THIRD-PARTY FILE fbfbda524f1d14b8
````text
---
name: twilio-security-hardening
description: >
  Secure Twilio applications against common attacks. Covers credential
  management (API keys vs auth tokens), request validation (webhook
  signature verification), PCI DSS compliance, HIPAA account requirements,
  SMS pumping prevention, geo-permissions, and account isolation patterns.
  Use this skill when developers are building or deploying Twilio apps.
---

## Overview

Security hardening is an **ongoing** concern — not a one-time setup. This skill covers account-level security decisions and application-level protection patterns that prevent credential leaks, fraud, and compliance violations.

**Lifecycle:** Choose numbers (`twilio-numbers-senders`) → Register (`twilio-compliance-onboarding`) → Follow traffic rules (`twilio-compliance-traffic`) → Secure everything (this skill)

---

## Credential Management

### API Keys vs Auth Tokens

| Credential | Scope | Revocable | Use when |
|-----------|-------|-----------|----------|
| **Auth Token** | Full account access | Only by rotating (invalidates ALL API keys) | Never in production — use API keys instead |
| **API Key + Secret** | Scoped, revocable individually | Yes — revoke one without affecting others | Production applications, CI/CD, server-side code |
| **Access Tokens** | Short-lived, client-specific | Expire automatically | Client-side SDKs (Voice, Video, Conversations) |

**Critical gotcha:** Rotating your Auth Token **invalidates ALL existing API keys**. This is a one-way door that can break every integration simultaneously. Use API keys from the start so you never need to rotate the Auth Token.

### Best Practices

- Store credentials in environment variables or a secrets manager — never in code
- Use different API keys per application/environment
- Rotate API keys on a schedule (quarterly minimum, monthly for HIPAA)
- Use sub-accounts to isolate customer credentials for ISV platforms — see `twilio-account-setup`

**Docs:** See `twilio-iam-auth-setup` for full credential setup patterns.

---

## Request Validation (Webhook Security)

Verify that webhook requests actually come from Twilio — not spoofed by attackers.

### X-Twilio-Signature Validation

Always use the SDK validator — don't implement HMAC-SHA1 manually:

**Node.js**
```javascript
const twilio = require("twilio");

app.post("/sms", (req, res) => {
    const valid = twilio.validateRequest(
        process.env.TWILIO_AUTH_TOKEN,
        req.headers["x-twilio-signature"],
        `https://yourdomain.com/sms`,
        req.body
    );
    if (!valid) return res.status(403).send("Forbidden");
    // Process webhook...
});
```

**Common mistakes:**
- Using HTTP URL when Twilio sends to HTTPS (URL must match exactly)
- Forgetting to include query string parameters in validation URL
- Not validating in production because "it worked in dev without it"
````
END THIRD-PARTY FILE fbfbda524f1d14b8

The third-party file has ended. Everything between the fbfbda524f1d14b8 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2890 of 7472 bytes. © Twilio · MIT · https://github.com/openai/plugins/tree/HEAD/plugins/twilio-developer-kit/skills/twilio-security-hardening/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md