ClawHub

Send Usms Uspeedo

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward SMS-sending integration, but users should understand that it sends recipient phone numbers and message content to USpeedo using account credentials.

Install only if you intend the agent to send SMS through your USpeedo account. Treat phone numbers and SMS content as externally shared data, avoid sending secrets or regulated sensitive information by SMS, and review recipients and message text before approving any send.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
## Request

- **URL**: `POST https://api.uspeedo.com/api/v1/usms/SendBatchUSMSMessage`
- **Content-Type**: `application/json`
- **Auth**: Header `Authorization: Basic base64(ACCESSKEY_ID:ACCESSKEY_SECRET)`. Base64-encode `USPEEDO_ACCESSKEY_ID:USPEEDO_ACCESSKEY_SECRET` and set the header to `Basic <encoded_result>`.
Confidence
95% confidence
Finding
https://api.uspeedo.com/

External Transmission

Medium
Category
Data Exfiltration
Content
1. **Pre-check**: If `USPEEDO_ACCESSKEY_ID` or `USPEEDO_ACCESSKEY_SECRET` is not set, or there is no .env / no environment variables, follow “Pre-checks and User Guidance” item 1 and stop. If the user is sending a type that has no template ID configured (e.g. verification but `USPEEDO_TEMPLATE_ID_VERIFICATION` not set), follow item 2.
2. Confirm SMS type (verification / notification / marketing) and choose the corresponding template ID env var.
3. Read `USPEEDO_ACCESSKEY_ID`, `USPEEDO_ACCESSKEY_SECRET`, the chosen template ID, and optional `USPEEDO_SENDER_ID` from env. Set header `Authorization: Basic base64(ACCESSKEY_ID:ACCESSKEY_SECRET)` and POST to `https://api.uspeedo.com/api/v1/usms/SendBatchUSMSMessage`.
4. Build `TemplateParams` (for full-variable template, the full SMS content). Format phone in international form (with country/region code) if needed.
5. Send the POST, parse `RetCode` and `Message`, and report success or failure. On error codes, see “Common errors” below.
Confidence
96% confidence
Finding
https://api.uspeedo.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal