security: fail-closed on Twilio webhook auth + drop x-post unpinned auto-install

[john-the-dev]

Summary

Two confirmed security findings from workspace/notes/security-audit-source-2026-07-06.md:

Finding #2 — Twilio webhook auth fails open (MEDIUM)

validate_twilio_signature in src/agent-api.py returned True when TWILIO_AUTH_TOKEN was unset:

if not auth_token:
    return True  # accepts ALL webhooks unauthenticated

An unauthenticated HTTP POST to /twilio/voice, /twilio/sms, or /twilio/transcription would create a task in the agent without any Twilio signature check. Widened by AGENT_API_BIND=0.0.0.0 (LAN exposure).

Fix: return False — the endpoint requires TWILIO_AUTH_TOKEN to be configured. Adds a 4-test regression suite (tests/agent-api-twilio-auth.test.py).

Finding #5 — x-post unpinned pip auto-install (LOW-MED)

skills/x-twitter/x-post.py ran pip3 install --break-system-packages requests requests-oauthlib as an import side-effect when the packages were missing. Unpinned installs are vulnerable to supply-chain attacks (typosquatting, compromised packages). --break-system-packages overrides OS protection.

Fix: Replace auto-install with sys.exit() printing clear install instructions. Operator installs deps once; the skill never self-modifies the environment.

Test plan

• python3 tests/agent-api-twilio-auth.test.py — all 4 tests pass
• CI passes (tsc + tests, coverage gate)
• Twilio users: set TWILIO_AUTH_TOKEN in .env (was required before; now enforced at the code level too)

🤖 Generated with Claude Code

https://claude.ai/code/session_01QB3qZQrwponfum2JFNvHeh

[github-actions]

Coverage Gate

✅ Diff coverage PASSES the 95% bar. Whole-tree (informational): 35%.

Diff Coverage

Diff: origin/main...HEAD, staged and unstaged changes

• src/agent-api.py (100%)

Summary

• Total: 1 line
• Missing: 0 lines
• Coverage: 100%

[github-actions]

@cla-assistant check

[qingyun-wu]

Cold-reviewed — no code defects found.

Twilio fail-closed (src/agent-api.py) — correct. Returning False when TWILIO_AUTH_TOKEN is unset closes the accept-all hole; the 4 regression tests cover no-token / empty-token / missing-sig / wrong-sig. ✅

x-post auto-install drop (skills/x-twitter/x-post.py) — correct hardening; dropping the unpinned --break-system-packages install removes a host-mutation/supply-chain risk. Verified sys is imported (line 21), so the new sys.exit(...) path exits cleanly rather than raising NameError. ✅

Two non-blocking notes:

1. Operational (before merge): this is a behavior change — any environment running Twilio voice/webhooks without TWILIO_AUTH_TOKEN set will now reject all webhooks. Correct posture, but confirm the token is set in the target .env or phone webhooks stop working. (The docstring already flags this.)
2. Scope: two concerns in one PR (Twilio auth + x-post install). Both from the same 07-06 audit and small, so not worth splitting — just noting per single-concern-per-PR.

No blockers from me; recommend merge after confirming (1). Merge stays your call.

[qingyun-wu]

Automated mergeability review (2026-07-09)

Signal: NOT MERGEABLE

Current blocker(s):

• Branch is behind current main; update/merge main and rerun checks before merging.

This is a conservative backlog triage signal. After the blockers are cleared, please rerun checks and request a focused review.