CMI CPaaS - WhatsApp OTP Sender

Send WhatsApp OTP (one-time password) messages via CMI OmniChannel RCS API. Use when user asks to send verification code, OTP, or authentication code via Wha...

This skill appears to do exactly what it claims, but it contains an explicit workaround that weakens network security: the Python script disables SSL certificate verification and the scripts avoid proxies to reach a server with a broken TLS configuration. Before installing or providing credentials: 1) Verify you trust the API provider (cpaas-rcs.cmidict.com) and the tenant you will use. 2) Prefer not to reuse long‑lived credentials; use short‑lived or scoped keys if possible and rotate them after testing. 3) Run the scripts in a controlled/sandboxed environment first to confirm behavior. 4) Ask the provider to fix their certificate configuration so you can re-enable standard verification and proxy traversal. 5) Ensure the agent or environment won't log or leak the AccessKeySecret or ApplicationSecret (avoid pasting secrets into public chat). If you cannot accept disabling TLS verification or bypassing your corporate proxy, do not use this skill until the API endpoint is corrected or the scripts are adapted to your environment.

Type: OpenClaw Skill Name: whatsapp-otp Version: 1.0.2 The skill bundle contains scripts (send_whatsapp_otp.py and send_whatsapp_otp.sh) that intentionally disable critical security controls to interact with the CMI OmniChannel RCS API (cpaas-rcs.cmidict.com:7081). Specifically, the Python script disables SSL certificate verification (CERT_NONE) and clears all system proxy environment variables. While these actions are documented in SKILL.md as workarounds for non-standard API configurations, they introduce significant vulnerabilities, such as susceptibility to Man-in-the-Middle (MitM) attacks, which could lead to the exposure of the sensitive API credentials requested from the user.