ClawHub
Back to skill

Security audit

Voipms Sms

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it says, but it handles SMS data and reusable VoIP.ms credentials in a way that can expose them through request URL logs.

Review before installing. Use only a dedicated VoIP.ms API sub-account limited to SMS, avoid sending highly sensitive messages through this tool, treat terminal output as sensitive, and prefer an implementation that sends credentials and message parameters in a POST body if the VoIP.ms API supports it. Rotate credentials if full request URLs may have been logged.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_sms.py:35
Finding

API Credentials and SMS Content Exposed in URL Query Parameters

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get_sms.py:54
Finding

API Credentials Exposed in SMS Retrieval URL Query Parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tainted flow: 'req' from os.environ.get (line 69, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/get_sms.py (reported line 72)May include surrounding context.

python
req = urllib.request.Request(url, headers={'User-Agent': 'OpenClaw/1.0'})

    try:
        with urllib.request.urlopen(req) as response:
            body = response.read().decode("utf-8")
    except Exception as exc:
        print(f"Error: API request failed: {exc}", file=sys.stderr)

Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_sms.py (reported line 54)May include surrounding context.

python
req = urllib.request.Request(url, headers={'User-Agent': 'OpenClaw/1.0'})

    try:
        with urllib.request.urlopen(req) as response:
            body = response.read().decode("utf-8")
    except Exception as exc:
        print(f"Error: API request failed: {exc}", file=sys.stderr)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code clearly implements SMS retrieval only: it parses optional DID and day-range arguments, loads VoIP.ms API credentials from environment variables, calls the VoIP.ms getSMS method, and outputs the result. This aligns with the retrieval portion of the description and is consistent with the stated lack of Bitwarden dependency. However, the declared purpose says the skill supports both sending and retrieving SMS messages, while this code chunk shows only retrieval behavior and no sending functionality. That is a material description-behavior mismatch for the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code is consistent with part of the description: it uses the VoIP.ms API and has no Bitwarden dependency. However, the declared purpose says the skill supports both sending and retrieving SMS messages, while this code chunk only sends SMS messages using the sendSMS API method. No retrieval functionality is present in the provided code. That is a material description-to-behavior mismatch for the supplied chunk, even though the sending portion is accurately represented.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documentation instructs use of environment variables for API credentials and describes network-capable scripts, but it does not declare any explicit tool scope or permissions. In agent ecosystems, missing scope declarations can allow broader-than-expected access to secrets and outbound connectivity, reducing transparency and making misuse harder to constrain or audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest describes sending and retrieving SMS via the VoIP.ms API and declares required username/password environment variables, but it provides no warning or disclosure about handling sensitive credentials or transmitting user message data to a third-party service. For a manifest/description file, the skill description should clearly warn about privacy and credential implications of these behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script places API username and password directly in the request URL query string. Even though the request uses HTTPS, URLs are commonly exposed in client logs, proxy logs, browser/history equivalents, debugging output, monitoring systems, and upstream infrastructure, which can leak long-lived credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script places API username, API password, destination number, and SMS message in the request URL query string. Even though the request uses HTTPS, query strings are more likely to be exposed through proxy logs, debugging tools, browser/history equivalents, upstream infrastructure, or exception telemetry, causing credential leakage and disclosure of message contents.

Content

No source excerpt is available for this finding.