← Back to Skills Marketplace
AI短信发送工具
by
xiaoweige1101
· GitHub ↗
· v1.0.7
· MIT-0
117
Downloads
1
Stars
0
Active Installs
8
Versions
Install in OpenClaw
/install send-sms
Description
通过创蓝短信平台发送模板短信
Usage Guidance
This skill appears to implement an SMS-sending helper and mostly behaves as documented, but you should verify one important inconsistency before installing: the bundled script defaults to posting to https://smssh.253.com/... while the documentation and links point to chuanglan.com. Confirm with the provider docs which API host you should use; if needed, set CHANGLAN_API_URL explicitly to the correct endpoint. Additional precautions: use a non-production/limited API account for testing, avoid placing credentials in world-readable files (the script will source a .env in the skill directory), consider rotating credentials after testing, and review network traffic or API logs to ensure messages go to the expected service. If you can't reconcile the endpoint mismatch, do not supply real credentials.
Capability Analysis
Type: OpenClaw Skill
Name: send-sms
Version: 1.0.7
The skill contains a shell injection vulnerability in 'send-sms.sh' because user-provided arguments (--phone, --template, and --vars) are embedded directly into a double-quoted heredoc used to construct a JSON payload. This allows for arbitrary command execution if the input contains shell metacharacters like $(command). While the script's functionality aligns with its stated purpose of sending SMS via the Chuanglan API (smssh.253.com), the lack of input sanitization presents a significant security risk.
Capability Assessment
Purpose & Capability
Name/description claim it integrates with 创蓝 (chuanglan.com). Required binaries (curl, jq, openssl) and required env vars (CHANGLAN_ACCOUNT, CHANGLAN_PASSWORD) are consistent with an SMS-sending skill. However, the script's default CHANGLAN_API_URL is set to https://smssh.253.com/msg/sms/v2/tpl/send, which is a different SMS provider domain than the chuanglan.com links in SKILL.md. This mismatch between documentation and the actual endpoint is unexpected and should be validated.
Instruction Scope
SKILL.md and the shipped send-sms.sh are self-consistent: they source credentials from environment variables or a .env next to the script, build a JSON request, and POST it to CHANGLAN_API_URL. The instructions do not attempt to read unrelated files or other environment variables. Note: the script will source a .env file in the skill directory if present — storing credentials there is convenient but carries the usual filesystem-security risks if the file is world-readable.
Install Mechanism
No install spec (instruction-only skill with a shell script). Nothing is downloaded or installed by the skill itself, so no high-risk install behavior is present.
Credentials
The skill asks only for CHANGLAN_ACCOUNT and CHANGLAN_PASSWORD, which is proportionate for an SMS API client. The script sends the password in the JSON payload to the configured API URL; while the request uses HTTPS by default, users should prefer API tokens or least-privilege credentials if available and avoid storing plaintext credentials in world-readable files.
Persistence & Privilege
Skill is not always-enabled and does not request persistent elevated privileges or modify other skills or system-wide settings. It only reads its own .env and environment variables.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install send-sms - After installation, invoke the skill by name or use
/send-sms - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.7
- 新增依赖 openssl，可提升安全性或功能支持
- 其他功能与用法无变化
v1.0.6
- 更新版本号至 1.0.6
- 无其它功能、配置或文档变更
v1.0.5
- 新增了对 curl 和 jq 命令行依赖的声明，确保发送短信功能正常运行
- 版本号更新为 1.0.5
v1.0.4
No functional changes in this version.
- No file changes detected for version 1.0.4.
- Documentation and usage remain unchanged from the previous release.
v1.0.3
- 增加创蓝短信平台背景介绍及注册链接，便于新用户快速上手
- 补充了API账号获取、企业与实名认证流程及如何添加IP白名单
- 更新配置引导，更详细说明环境变量与.env文件设置
- 明确使用方法，常量模板短信不再强制要求 --vars 参数
- 新增相关链接，包括平台主页、文档、注册入口等，提升资料可达性
- 增添白名单配置的特殊注意事项
v1.0.2
- No changes detected in this version.
- Documentation and functionality remain the same.
v1.0.1
**Summary: Improved configuration methods and clarified usage for sending template SMS via Chuanglan.**
- Added support for configuration via environment variables or a .env file (no longer requires copying/modifying config.conf).
- Updated usage instructions to clarify that template variables are optional for constant templates.
- Provided separate usage examples for variable and constant templates.
- Added error code 130 (请求参数错误) to the error code table.
v1.0.0
发布创蓝短信发送工具
Metadata
Frequently Asked Questions
What is AI短信发送工具?
通过创蓝短信平台发送模板短信. It is an AI Agent Skill for Claude Code / OpenClaw, with 117 downloads so far.
How do I install AI短信发送工具?
Run "/install send-sms" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is AI短信发送工具 free?
Yes, AI短信发送工具 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does AI短信发送工具 support?
AI短信发送工具 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created AI短信发送工具?
It is built and maintained by xiaoweige1101 (@xiaoweige1101); the current version is v1.0.7.
More Skills