← 返回 Skills 市场
AI短信发送工具
作者
xiaoweige1101
· GitHub ↗
· v1.0.7
· MIT-0
117
总下载
1
收藏
0
当前安装
8
版本数
在 OpenClaw 中安装
/install send-sms
功能描述
通过创蓝短信平台发送模板短信
安全使用建议
This skill appears to implement an SMS-sending helper and mostly behaves as documented, but you should verify one important inconsistency before installing: the bundled script defaults to posting to https://smssh.253.com/... while the documentation and links point to chuanglan.com. Confirm with the provider docs which API host you should use; if needed, set CHANGLAN_API_URL explicitly to the correct endpoint. Additional precautions: use a non-production/limited API account for testing, avoid placing credentials in world-readable files (the script will source a .env in the skill directory), consider rotating credentials after testing, and review network traffic or API logs to ensure messages go to the expected service. If you can't reconcile the endpoint mismatch, do not supply real credentials.
功能分析
Type: OpenClaw Skill
Name: send-sms
Version: 1.0.7
The skill contains a shell injection vulnerability in 'send-sms.sh' because user-provided arguments (--phone, --template, and --vars) are embedded directly into a double-quoted heredoc used to construct a JSON payload. This allows for arbitrary command execution if the input contains shell metacharacters like $(command). While the script's functionality aligns with its stated purpose of sending SMS via the Chuanglan API (smssh.253.com), the lack of input sanitization presents a significant security risk.
能力评估
Purpose & Capability
Name/description claim it integrates with 创蓝 (chuanglan.com). Required binaries (curl, jq, openssl) and required env vars (CHANGLAN_ACCOUNT, CHANGLAN_PASSWORD) are consistent with an SMS-sending skill. However, the script's default CHANGLAN_API_URL is set to https://smssh.253.com/msg/sms/v2/tpl/send, which is a different SMS provider domain than the chuanglan.com links in SKILL.md. This mismatch between documentation and the actual endpoint is unexpected and should be validated.
Instruction Scope
SKILL.md and the shipped send-sms.sh are self-consistent: they source credentials from environment variables or a .env next to the script, build a JSON request, and POST it to CHANGLAN_API_URL. The instructions do not attempt to read unrelated files or other environment variables. Note: the script will source a .env file in the skill directory if present — storing credentials there is convenient but carries the usual filesystem-security risks if the file is world-readable.
Install Mechanism
No install spec (instruction-only skill with a shell script). Nothing is downloaded or installed by the skill itself, so no high-risk install behavior is present.
Credentials
The skill asks only for CHANGLAN_ACCOUNT and CHANGLAN_PASSWORD, which is proportionate for an SMS API client. The script sends the password in the JSON payload to the configured API URL; while the request uses HTTPS by default, users should prefer API tokens or least-privilege credentials if available and avoid storing plaintext credentials in world-readable files.
Persistence & Privilege
Skill is not always-enabled and does not request persistent elevated privileges or modify other skills or system-wide settings. It only reads its own .env and environment variables.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install send-sms - 安装完成后，直接呼叫该 Skill 的名称或使用
/send-sms触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.7
- 新增依赖 openssl，可提升安全性或功能支持
- 其他功能与用法无变化
v1.0.6
- 更新版本号至 1.0.6
- 无其它功能、配置或文档变更
v1.0.5
- 新增了对 curl 和 jq 命令行依赖的声明，确保发送短信功能正常运行
- 版本号更新为 1.0.5
v1.0.4
No functional changes in this version.
- No file changes detected for version 1.0.4.
- Documentation and usage remain unchanged from the previous release.
v1.0.3
- 增加创蓝短信平台背景介绍及注册链接，便于新用户快速上手
- 补充了API账号获取、企业与实名认证流程及如何添加IP白名单
- 更新配置引导，更详细说明环境变量与.env文件设置
- 明确使用方法，常量模板短信不再强制要求 --vars 参数
- 新增相关链接，包括平台主页、文档、注册入口等，提升资料可达性
- 增添白名单配置的特殊注意事项
v1.0.2
- No changes detected in this version.
- Documentation and functionality remain the same.
v1.0.1
**Summary: Improved configuration methods and clarified usage for sending template SMS via Chuanglan.**
- Added support for configuration via environment variables or a .env file (no longer requires copying/modifying config.conf).
- Updated usage instructions to clarify that template variables are optional for constant templates.
- Provided separate usage examples for variable and constant templates.
- Added error code 130 (请求参数错误) to the error code table.
v1.0.0
发布创蓝短信发送工具
元数据
常见问题
AI短信发送工具 是什么？
通过创蓝短信平台发送模板短信. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 117 次。
如何安装 AI短信发送工具？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install send-sms」即可一键安装，无需额外配置。
AI短信发送工具 是免费的吗？
是的，AI短信发送工具 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
AI短信发送工具 支持哪些平台？
AI短信发送工具 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 AI短信发送工具？
由 xiaoweige1101（@xiaoweige1101）开发并维护，当前版本 v1.0.7。
推荐 Skills