Voipms Sms

OpenClaw skill for sending and retrieving SMS messages via the VoIP.ms API (no Bitwarden dependency).

This skill appears to do what it claims: it uses the VoIP.ms API and only needs your VoIP.ms API username/password. Before installing, consider: 1) The source and homepage are unknown — if you don't trust the publisher, review the two Python scripts yourself (they are short and included). 2) The scripts put API username/password in the URL query string (GET) — this can be recorded in server logs or by intermediate proxies; prefer a dedicated sub-account as suggested or an API token/mechanism that avoids embedding credentials in URLs. 3) Store credentials in a secure place (not a long-lived shared shell session) and rotate/revoke the sub-account credentials if you stop using the skill. If you want higher assurance, ask the publisher for a provenance URL or an official homepage/source repository.

Type: OpenClaw Skill Name: voipms-sms Version: 1.0.1 The skill bundle is benign. All files align with the stated purpose of sending and retrieving SMS messages via the VoIP.ms API. The Python scripts (`scripts/get_sms.py`, `scripts/send_sms.py`) correctly read API credentials from environment variables and interact with the official VoIP.ms API endpoint. The `SKILL.md` provides clear instructions and even includes a security best practice recommendation to use a least-privilege sub-account. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection against the agent, or obfuscation. The inclusion of API credentials in the URL query string is a minor concern for logging but is a common API interaction pattern and not indicative of malicious intent or a direct vulnerability within the skill's code.