ClawHub
Back to skill

Security audit

Verimor SMS

Security checks for vulnerabilities and agentic risk

Overview

This SMS skill is mostly coherent with its stated purpose, but it gives agents direct authority to send paid messages and change campaign or blacklist state without clear confirmation safeguards, and it places account credentials in URL query strings.

Review this skill carefully before installing. It should be limited to users who intentionally want Verimor SMS account control from the agent, and operators should add explicit confirmation for every send, campaign cancellation, and blacklist change. Prefer safer credential handling if Verimor supports it, and rotate credentials if these URL-based commands have already been used in logs or shared environments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:67
Finding

API Credentials Exposed in URL Query Strings

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
openclaw:
    requires:
      bins:
        - curl
        - jq
      config:
        - VERIMOR_USERNAME

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sends credentials and message content to a third-party SMS provider but does not clearly warn users that their data and secrets are used in external API requests. This increases the risk of users disclosing sensitive content without informed consent and may create compliance or privacy problems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases for sending SMS are broad conversational phrases like 'mesaj at' and 'bildirim gönder'. In an agentic environment, this can cause unintended activation and transmission of user-supplied content to external recipients, potentially resulting in unauthorized messaging, privacy issues, and financial cost.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Campaign cancellation and blacklist modification are state-changing operations with potentially irreversible business impact, yet the skill provides no explicit warning or confirmation requirement. An accidental or ambiguous invocation could cancel scheduled messaging or block recipients, disrupting communications and causing operational harm.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Kullanıcı ileri tarihli bir kampanyayı iptal etmek istediğinde:

bash
curl -s -X POST https://sms.verimor.com.tr/v2/cancel/KAMPANYA_ID \
  -H "Content-Type: application/json" \
  -d '{"username": "'"$VERIMOR_USERNAME"'", "password": "'"$VERIMOR_PASSWORD"'"}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

All user-facing instructions, trigger phrases, and output expectations are written in Turkish, and the skill assumes Turkish-number formatting and Turkish responses without stating that the locale is intentionally limited or offering opt-in language selection. This can violate language/locale policy when a skill forces a specific language by default.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description says the skill can send SMS, query balance, get reports, list headers, and manage blacklists, but it also documents a separate capability to cancel scheduled campaigns. Campaign cancellation is a state-changing operation not mentioned in the declared description, so the stated scope is narrower than the documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.