← Back to Skills Marketplace
279
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install sms-gateway
Description
Send and receive SMS using a local sms-gate.app instance running on Android (via Termux) or a dedicated device. Use when the user needs to send text messages...
Usage Guidance
This skill appears to implement a legitimate local SMS gateway client, but be aware of hidden forwarding and local files:
- The webhook receiver (scripts/webhook_server.py) automatically forwards incoming SMS payloads to OPENCLAW_WEBHOOK_URL, which defaults to http://localhost:8080/webhook unless you set OPENCLAW_WEBHOOK_URL='disabled'. SKILL.md does not document this. Before running the webhook server, explicitly set OPENCLAW_WEBHOOK_URL to 'disabled' (or to a URL you trust) if you do not want incoming message content forwarded.
- The skill caches JWT tokens to .token.json in the skill directory and writes ~/.sms_gateway_last_check. These files contain sensitive data (access_token and timestamps). If you install the skill, ensure the skill directory is not world-readable and consider clearing the token file when not needed.
- The skill reads a .env file in its root (auth._load_env). Follow the README guidance to create .env, but be aware credentials in .env are used directly; keep that file private.
- When configuring webhooks via manage_webhooks.py, avoid registering public/unknown endpoints for sms:received unless you trust them, because message bodies can be delivered to those endpoints.
- If you want to proceed: audit or modify scripts/webhook_server.py to change the default OPENCLAW_WEBHOOK_URL to 'disabled' or make forwarding opt-in, and confirm file permissions for .token.json and .env. If you are unsure, run the scripts in a controlled environment (not exposed to the internet) and review outgoing network traffic while testing.
Capability Analysis
Type: OpenClaw Skill
Name: sms-gateway
Version: 1.0.0
The sms-gateway skill provides a standard interface for interacting with a self-hosted Android SMS gateway (sms-gate.app). The bundle includes well-structured Python scripts for sending SMS, checking delivery status, polling for incoming messages, and managing webhooks using standard library components (urllib). Authentication is handled via JWT with local token caching in .token.json, and the instructions in SKILL.md are strictly aligned with the stated functionality without any evidence of prompt injection or malicious intent.
Capability Assessment
Purpose & Capability
Name/description, required binaries (python3), and the included scripts (send, list, status, health, webhook management) are consistent with a local SMS gateway integration. The requested env vars (SMS_GATE_URL, SMS_GATE_USER, SMS_GATE_PASS) are appropriate for this purpose.
Instruction Scope
SKILL.md documents how to run the provided scripts but omits a runtime behavior present in the code: scripts/webhook_server.py will attempt to forward every incoming SMS webhook to an OPENCLAW_WEBHOOK_URL (default http://localhost:8080/webhook) unless that env var is explicitly set to 'disabled'. That forwarding is not documented in SKILL.md and thus is unexpected scope creep — it transmits message payloads to another HTTP endpoint by default.
Install Mechanism
Instruction-only skill with no install spec; included code uses only Python stdlib. No remote downloads, no archive extraction, and no extra packages are pulled in by the skill.
Credentials
Declared env vars (SMS_GATE_URL/USER/PASS) are proportionate. However, the code reads additional environment variables not declared in the manifest/SKILL.md (OPENCLAW_WEBHOOK_URL controls automatic forwarding) and also reads a local .env in the skill root via auth._load_env. The presence of an undeclared forwarding target is the primary proportionality concern because it can cause exfiltration of incoming SMS content to an endpoint the user did not configure in the SKILL.md.
Persistence & Privilege
The skill writes a token cache (.token.json) into the skill root and a last-check state file (~/.sms_gateway_last_check) in the user's home; this is normal for caching but stores sensitive access_token in plaintext JSON. The skill is not always-enabled and does not modify other skills or system-wide settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install sms-gateway - After installation, invoke the skill by name or use
/sms-gateway - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of sms-gateway skill:
- Send and receive SMS via a local sms-gate.app instance on Android phone like Google Pixel 3
- Scripts provided for sending SMS, checking delivery status, listing message history, and managing webhooks for incoming SMS and delivery confirmations.
- Requires environment variables for gateway URL, user, and password.
- Detailed setup instructions and common usage patterns included.
- Supports webhook integration for receiving incoming SMS, with guidance for both local and remote setups (e.g., ngrok).
Metadata
Frequently Asked Questions
What is FreeSmsGateway?
Send and receive SMS using a local sms-gate.app instance running on Android (via Termux) or a dedicated device. Use when the user needs to send text messages... It is an AI Agent Skill for Claude Code / OpenClaw, with 279 downloads so far.
How do I install FreeSmsGateway?
Run "/install sms-gateway" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is FreeSmsGateway free?
Yes, FreeSmsGateway is completely free (open-source). You can download, install and use it at no cost.
Which platforms does FreeSmsGateway support?
FreeSmsGateway is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created FreeSmsGateway?
It is built and maintained by Minde (@minstn); the current version is v1.0.0.
More Skills