telephony
Enables Hermes to manage phone capabilities, including SMS, MMS, and AI-driven calls using Twilio and Bland.ai.
Install this skill
Security score
The telephony skill was audited on May 17, 2026 and we found 25 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 24 | - poll inbound SMS for that number with no webhook server required |
Webhook reference - potential data exfiltration
| 39 | It does **not** turn Hermes into a real-time inbound phone gateway. Inbound SMS is handled by polling the Twilio REST API. That is enough for many workflows, including notifications and some one-time- |
Webhook reference - potential data exfiltration
| 63 | - cleanest future path to inbound webhooks or call handling |
Webhook reference - potential data exfiltration
| 267 | ### C. Check inbound texts later with no webhook server |
Webhook reference - potential data exfiltration
| 323 | - Hermes STT/TTS alone is not being used here as a full duplex phone conversation engine; that would require a much heavier streaming/webhook integration than this skill is trying to introduce |
Webhook reference - potential data exfiltration
| 386 | - webhook-based live SMS push into the agent loop |
Access to hidden dotfiles in home directory
| 20 | - save provider credentials into `~/.hermes/.env` |
Access to hidden dotfiles in home directory
| 107 | ### `~/.hermes/.env` |
Access to hidden dotfiles in home directory
| 118 | ### `~/.hermes/telephony_state.json` |
Access to hidden dotfiles in home directory
| 133 | SCRIPT="$(find ~/.hermes/skills -path '*/telephony/scripts/telephony.py' -print -quit)" |
Access to hidden dotfiles in home directory
| 244 | 3. Buy it and save it into `~/.hermes/.env` + state: |
Access to hidden dotfiles in home directory
| 406 | 3. persist that number to `~/.hermes/.env` |
Access to .env file
| 20 | - save provider credentials into `~/.hermes/.env` |
Access to .env file
| 107 | ### `~/.hermes/.env` |
Access to .env file
| 244 | 3. Buy it and save it into `~/.hermes/.env` + state: |
Access to .env file
| 406 | 3. persist that number to `~/.hermes/.env` |
External URL reference
| 152 | - https://www.twilio.com/try-twilio |
External URL reference
| 189 | - https://app.bland.ai |
External URL reference
| 200 | - https://dashboard.vapi.ai |
External URL reference
| 264 | python3 "$SCRIPT" twilio-send-sms "+15551230000" "Here is the chart." --media-url "https://example.com/chart.png" |
External URL reference
| 301 | python3 "$SCRIPT" twilio-call "+155****0000" --audio-url "https://example.com/briefing.mp3" |
External URL reference
| 414 | - Twilio phone numbers: https://www.twilio.com/docs/phone-numbers/api |
External URL reference
| 415 | - Twilio messaging: https://www.twilio.com/docs/messaging/api/message-resource |
External URL reference
| 416 | - Twilio voice: https://www.twilio.com/docs/voice/api/call-resource |
External URL reference
| 418 | - Bland.ai: https://app.bland.ai/ |