telephony — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited telephony (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This optional skill gives Hermes practical phone capabilities while keeping telephony out of the core tool list.
It ships with a helper script, scripts/telephony.py, that can:
~/.hermes/.env<Say> or <Play>This skill is meant to cover the practical phone tasks users actually want:
It does not turn Hermes into a real-time inbound phone gateway. Inbound SMS is handled by polling the Twilio REST API. That is enough for many workflows, including notifications and some one-time-code retrieval, without adding core webhook infrastructure.
Use this logic instead of hardcoded provider routing:
Use Twilio.
Why:
Use cases:
Use Bland.ai.
Why:
Tradeoff:
Use Twilio + Vapi.
Why:
Recommended flow:
VAPI_PHONE_NUMBER_IDai-call --provider vapiUse Twilio direct call with a public audio URL.
Why:
text_to_speech plus a public file host or tunnelThe skill persists telephony state in two places:
~/.hermes/.envUsed for long-lived provider credentials and owned-number IDs, for example:
TWILIO_ACCOUNT_SIDTWILIO_AUTH_TOKENTWILIO_PHONE_NUMBERTWILIO_PHONE_NUMBER_SIDBLAND_API_KEYVAPI_API_KEYVAPI_PHONE_NUMBER_IDPHONE_PROVIDER (AI call provider: bland or vapi)~/.hermes/telephony_state.jsonUsed for skill-only state that should survive across sessions, for example:
This means:
diagnose can tell you what number is already configuredtwilio-inbox --since-last --mark-seen can continue from the previous checkpointAfter installing this skill, locate the script like this:
SCRIPT="$(find ~/.hermes/skills -path '*/telephony/scripts/telephony.py' -print -quit)"If SCRIPT is empty, the skill is not installed yet.
This is an official optional skill, so install it from the Skills Hub:
hermes skills search telephony
hermes skills install official/productivity/telephonySign up at:
Then save credentials into Hermes:
python3 "$SCRIPT" save-twilio ACXXXXXXXXXXXXXXXXXXXXXXXXXXXX your_auth_token_hereSearch for available numbers:
python3 "$SCRIPT" twilio-search --country US --area-code 702 --limit 5Buy and remember a number:
python3 "$SCRIPT" twilio-buy "+17025551234" --save-envList owned numbers:
python3 "$SCRIPT" twilio-ownedSet one of them as the default later:
python3 "$SCRIPT" twilio-set-default "+17025551234" --save-env
# or
python3 "$SCRIPT" twilio-set-default PNXXXXXXXXXXXXXXXXXXXXXXXXXXXX --save-envSign up at:
Save config:
python3 "$SCRIPT" save-bland your_bland_api_key --voice masonSign up at:
Save the API key first:
python3 "$SCRIPT" save-vapi your_vapi_api_keyImport your owned Twilio number into Vapi and persist the returned phone number ID:
python3 "$SCRIPT" vapi-import-twilio --save-envIf you already know the Vapi phone number ID, save it directly:
python3 "$SCRIPT" save-vapi your_vapi_api_key --phone-number-id vapi_phone_number_id_hereAt any time, inspect what the skill already knows:
python3 "$SCRIPT" diagnoseUse this first when resuming work in a later session.
python3 "$SCRIPT" save-twilio AC... auth_token_herepython3 "$SCRIPT" twilio-search --country US --area-code 702 --limit 10~/.hermes/.env + state:python3 "$SCRIPT" twilio-buy "+17025551234" --save-envpython3 "$SCRIPT" diagnoseThis shows the remembered default number and inbox checkpoint state.
python3 "$SCRIPT" twilio-send-sms "+15551230000" "Your deployment completed successfully."With media:
python3 "$SCRIPT" twilio-send-sms "+15551230000" "Here is the chart." --media-url "https://example.com/chart.png"Poll the inbox for the default Twilio number:
python3 "$SCRIPT" twilio-inbox --limit 20Only show messages that arrived after the last checkpoint, and advance the checkpoint when you're done reading:
python3 "$SCRIPT" twilio-inbox --since-last --mark-seenThis is the main answer to “how do I access messages the number receives next time the skill is loaded?”
python3 "$SCRIPT" twilio-call "+15551230000" --message "Hello! This is Hermes calling with your status update." --voice Polly.JoannaThis is the main path for reusing Hermes's existing text_to_speech support.
Use this when:
<Say>Generate or host audio separately, then:
python3 "$SCRIPT" twilio-call "+155****0000" --audio-url "https://example.com/briefing.mp3"Recommended Hermes TTS -> Twilio Play workflow:
text_to_speech.--audio-url.Example agent flow:
text_to_speechtwilio-call --audio-url ... to deliver it by phoneGood hosting options for the MP3:
Important note:
If you need to press digits after the call connects, use --send-digits. Twilio interprets w as a short wait.
python3 "$SCRIPT" twilio-call "+18005551234" --message "Connecting to billing now." --send-digits "ww1w2w3"This is useful for reaching a specific menu branch before handing off to a human or delivering a short status message.
python3 "$SCRIPT" ai-call "+15551230000" "Call the dental office, ask for a cleaning appointment on Tuesday afternoon, and if they do not have Tuesday availability, ask for Wednesday or Thursday instead." --provider bland --voice mason --max-duration 3Check status:
python3 "$SCRIPT" ai-status <call_id> --provider blandAsk Bland analysis questions after completion:
python3 "$SCRIPT" ai-status <call_id> --provider bland --analyze "Was the appointment confirmed?,What date and time?,Any special instructions?"python3 "$SCRIPT" vapi-import-twilio --save-envpython3 "$SCRIPT" ai-call "+15551230000" "You are calling to make a dinner reservation for two at 7:30 PM. If that is unavailable, ask for the nearest time between 6:30 and 8:30 PM." --provider vapi --max-duration 4python3 "$SCRIPT" ai-status <call_id> --provider vapiWhen the user asks for a call or text:
diagnose if configuration state is unclear.Those would require more infrastructure than a pure optional skill.
twilio-inbox polls the REST API; it is not instant push delivery.After setup, you should be able to do all of the following with just this skill:
diagnose shows provider readiness and remembered state~/.hermes/.env~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.