Sms

Manage SMS templates with variable substitution and formatting. Use when preparing bulk messages.

This skill appears to do what it claims and does not request credentials or network access. Before installing, consider: (1) review or run the script in a safe environment — the script contains sloppy shell coding (unquoted variables, single-quoted echoes that prevent variable expansion) that can lead to incorrect behavior or path-splitting; (2) don't run it as a privileged user; (3) back up ~/.local/share/sms if you already have data there; (4) if you plan to use it in automation, patch the script to properly quote variables (e.g., use "$var") and fix the echoed messages so variables expand, and validate user-supplied names/paths to avoid accidental file overwrite or option injection; (5) prefer skills from a trusted/published source when possible.

Type: OpenClaw Skill Name: sms Version: 3.0.0 The script `scripts/script.sh` contains multiple shell injection vulnerabilities and unsafe file operations due to a lack of variable quoting in the `create`, `preview`, and `export` commands. Specifically, `cmd_export` allows copying the template database to arbitrary file paths, and `cmd_create` constructs strings for shell execution using unquoted input. While the tool appears to be a legitimate template manager, these flaws represent significant security risks that could be exploited if the agent passes unsanitized input.