Telnyx Bot Signup

Automated Telnyx bot account signup via Proof of Work challenge

This skill automates Telnyx's PoW signup flow and includes a solver script — that's consistent with the description. However, the registry metadata's declaration that TELNYX_API_KEY is the primary credential does not match the documented flow (the skill creates a new API key rather than requiring one). Do not provide an existing TELNYX_API_KEY to this skill unless you understand why it's needed. Also be careful when pasting the single-use sign-in link or session token: that link yields a session token and can be used to create API keys, so only paste it into a trusted environment and avoid sending it to public or third-party services. If you want to proceed, verify the skill's publisher/source, run the provided pow_solver.py locally (in a background worker or isolated environment because it can be CPU-intensive), and prefer using official Telnyx web signup flows if you have doubts.

Type: OpenClaw Skill Name: telnyx-bot-signup Version: 1.1.0 The skill's stated purpose is to automate Telnyx bot account signup, which is benign. However, the `scripts/pow_solver.py` contains a potential remote code execution vulnerability: the `getattr(hashlib, algorithm)` call uses an `algorithm` parameter that, if controlled by an attacker (e.g., via a manipulated Telnyx API response or prompt injection), could execute arbitrary functions. Additionally, the skill instructs the agent to `curl -L` a URL obtained from email or user input, which could be exploited if a malicious link is provided without proper validation by the agent. These are significant vulnerabilities that allow attacks, leading to a 'suspicious' classification.