CMI CPaaS - SMS Sender

Send batch SMS messages to up to 100 domestic or international numbers via CloudSMS API with optional custom signature and content.

What to consider before installing or running this skill: - The code and instructions match the stated purpose: it sends SMS to the CloudSMS API and requires Channel ID + Auth Key. If you trust the provider, the design is reasonable. - The skill clears proxy environment variables inside the script, which will bypass any system or corporate proxy/monitoring. If you operate in a monitored environment or need outgoing traffic to go through an inspection proxy, do not run this script until that behavior is removed or explained. - Verify the CloudSMS endpoint (https://cpaas-sms.cmidict.com:1820/uips) and the provider's legitimacy before supplying credentials. The skill has no homepage and the source is unknown — prefer official provider docs. - Do not use production credentials initially: test with a throwaway or test account and a small number of recipient numbers. - The skill depends on Python requests but has no install instructions; ensure the runtime environment has that dependency or add an explicit install step. - Review the script yourself (or have an admin do so). Look for anything that would exfiltrate credentials or send data to unexpected hosts. The script currently only posts to the declared API but the proxy bypass increases risk surface. - If you proceed, consider running in an isolated environment or sandbox and monitor network traffic to confirm it only talks to the expected API. - If you require changes: remove or make proxy clearing optional, add explicit dependency installation guidance, and document the provider and TLS/certificate expectations.

Type: OpenClaw Skill Name: sms-sender Version: 1.0.0 The skill facilitates bulk SMS sending via a third-party API (cpaas-sms.cmidict.com). It is classified as suspicious due to a significant shell injection vulnerability; the SKILL.md instructions direct the AI agent to construct a shell command using unvalidated user input (message content, phone numbers), which could lead to Remote Code Execution (RCE) if the agent does not properly escape the strings. Additionally, the script send_bulk_sms.py explicitly clears system proxy environment variables, an unusual behavior that could be intended to bypass local network security monitoring.