Android SMS Gateway

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:43 PM UTC
• Version: 2.0.0

Overview

The skill mostly matches its SMS gateway purpose, but it needs Review because it handles sensitive SMS data and credentials with weak transport and webhook safeguards.

Install only if you are comfortable giving the agent scripts access to send SMS, read received SMS, and use gateway credentials. Prefer HTTPS, VPN, or a private trusted network; avoid public webhook collectors for real SMS traffic; use dry-run before bulk sends; protect config files; and delete test webhooks after use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/receive_sms.sh:152

Finding

SMS content and gateway credentials can be transmitted over plaintext HTTP

Content

View full analysis

/dev/null) || { log_error "Failed to connect to gateway" exit 1 } ``` Related affected locations include: - `scripts/send_sms.sh:191-221` - `scripts/bulk_sms.sh:239-258` - `scripts/check_status.sh:139-155` - `scripts/send_sms_capcom6.sh:238-266` - `scripts/bulk_sms_capcom6.sh:281-320,333-353` - `scripts/check_status_capcom6.sh:172-193` - `scripts/register_webhook_capcom6.sh:231-250` - `SKILL.md:50,70,104-107,130,139` - `references/api_reference.md:13,37-38,61-66,106-107,222-226,269-274` - `references/capcom6_reference.md:16-18,29-48` ### Technical Analysis The scripts accept a user-configured gateway URL without enforcing HTTPS. The documented default local configuration uses HTTP. Requests then attach either a bearer token or Basic Authentication credentials and, depending on the operation, transmit recipient numbers, message bodies, received SMS records, and device-status information. Bearer tokens and Basic Authentication credentials provide no trans ...[truncated 1685 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_sms.sh:191

Finding

User-controlled values are interpolated into JSON without encoding

Content

View full analysis

/dev/null) || { log_error "Failed to connect to gateway at $GATEWAY_URL" exit 1 } ``` ### Technical Analysis The script inserts the recipient, message, and SIM-slot values directly into a JSON string. It does not apply JSON escaping to quotation marks, backslashes, newlines, control characters, or other special values. For example, a message containing a quotation mark can terminate the intended JSON string. A crafted value can then introduce additional properties if the receiving API accepts the ...[truncated 1733 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/register_webhook_capcom6.sh:74

Finding

Documentation recommends forwarding incoming SMS to a public webhook service

Content

View full analysis

/dev/null) || { log_error "Failed to connect to gateway" exit 1 } http_code=$(echo "$response" | tail -n1) local body=$(echo "$response" | sed '$d') log_verbose "HTTP $http_code" if [[ "$http_code" == "200" || "$http_code" == "201" ]]; then log_info "✓ Webhook registered successfully" echo "" echo " Webhook ID: $webhook_id" echo " U ...[truncated 2357 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code clearly implements outbound SMS sending only. It validates recipients, loads gateway credentials, and posts message payloads to a /message endpoint for either single or multi-recipient sends. There is no code for receiving SMS, polling inboxes, webhook handling, message retrieval, or any other inbound SMS functionality. That is a material mismatch because the declared description says the skill is for sending/receiving SMS. Additionally, while the description suggests broader support for popular SMS gateway apps, this code is tailored to a specific capcom6 API structure and endpoint. The primary purpose still falls within self-hosted Android SMS sending, so the mismatch is not total, but the undeclared absence of receive capability makes the description inaccurate.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The script’s primary function aligns substantially with SMS sending via an Android SMS gateway over HTTP. However, the declared description says the skill supports both sending and receiving SMS, while the provided code chunk only implements outbound sending. Additionally, the description emphasizes self-hosted use without third-party providers, but the code includes a cloud mode that hardcodes a third-party service endpoint. These are material description-to-behavior gaps, even though the core sending behavior is broadly consistent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api_reference.md (reported line 166)May include surrounding context.

md

---

#### DELETE /messages/:id

Delete a message from history.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/api_reference.md (reported line 337)May include surrounding context.

eway on LAN 2. Strong tokens: 32+ character random strings 3. HTTPS: Use reverse proxy if exposing externally 4. Firewall: Restrict access to gateway port 5. Monitoring: Log all API requests

---

Troubleshooting

Connection Refused

bash

# Check phone is reachable
ping PHONE_IP

# Check app is running
# On phone: Open SMS Gateway app, verify server started

# Check port
nmap -p 8080 PHONE_IP

Authentication Failed

bash

# Verify token matches app settings
curl -v http://PHONE_IP:8080/api/v1/status \
  -H "Authorization: Bearer YOUR_TOKEN"

# Check for typos, trailing spaces

Message Not Delivered

1. Check phone has signal
2. Verify SMS plan/credit
3. Check app logs for errors
4. Verify recipient number format
5. Check carrier spam filters

---

Alternative Apps

If the recommended app doesn't work for your device, try:

App	GitHub	Notes
SMS Gateway API	itsmeichigo/SMSGateway	⭐ Recommended, active

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents shell-script execution but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, this increases the chance the skill will be executed with broader shell capability than users expect, which can enable unintended command execution or unsafe file/network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill handles highly sensitive communications data—phone numbers, message bodies, and potentially authentication codes—without prominent privacy and data-handling warnings. Users may expose personal or regulated data through SMS APIs and logs without understanding retention, transport, and disclosure risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation encourages placement of tokens, usernames, and passwords in environment variables and config files without strong warning about secret exposure. In practice, such secrets can leak through shell history, process inspection, misconfigured home-directory permissions, backups, or accidental commits.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

Option 2: Config File

Create ~/.openclaw/sms-gateway.json:

json

{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill explicitly supports a cloud API endpoint, which means SMS content, recipient numbers, and credentials may be transmitted to a third-party service outside the local network. In the context of a tool marketed as self-hosted and privacy-preserving, this increases the risk of unintended data disclosure and trust-boundary expansion.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

bash

export SMS_GATEWAY_URL="http://192.168.1.100:8080"  # Local server
# export SMS_GATEWAY_URL="https://api.sms-gate.app/3rdparty/v1"  # Cloud
export SMS_GATEWAY_USER="your-username"
export SMS_GATEWAY_PASS="your-password"
export SMS_GATEWAY_TIMEOUT="30"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Webhook registration for incoming SMS can forward message content and sender metadata to an external server, but the documentation does not prominently warn users of that privacy and exfiltration risk. This is especially dangerous because incoming SMS may contain passwords, MFA codes, personal data, or incident-response information.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

• App: SMS Gateway API (itsmeichigo/SMSGateway)
• Phone: Samsung Galaxy, IP: 192.168.1.100
• Port: 8080
• Token: Stored in ~/.openclaw/sms-gateway.json (chmod 600)

text

## API Reference

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

- **Strong tokens:** Use random API tokens (32+ chars)
- **Token rotation:** Rotate tokens periodically
- **File permissions:** `chmod 600 ~/.openclaw/sms-gateway.json`

### Rate Limiting

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

bash

# Cron job for daily security reminder
# crontab -e
0 9 * * * /path/to/send_sms.sh --to "[phone]" --message "Daily security check: Review logs"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 37)May include surrounding context.

Request:

bash

curl http://PHONE_IP:8080/api/v1/status \
  -H "Authorization: Bearer YOUR_TOKEN"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 144)May include surrounding context.

Request:

bash

curl -X GET "http://PHONE_IP:8080/api/v1/messages/sent?limit=10" \
  -H "Authorization: Bearer YOUR_TOKEN"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents a DELETE endpoint that removes message history, but it does not include any warning that the operation is destructive or potentially irreversible. For markdown files, safety-impacting behaviors that affect user data should be explicitly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The webhook section tells users to configure an external callback URL and shows SMS metadata being transmitted, but it does not warn that message identifiers, phone numbers, delivery status, and timing data will leave the local gateway environment. In a security-focused context, omission of this warning can lead to inadvertent disclosure of sensitive communications metadata to third-party infrastructure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/capcom6_reference.md (reported line 29)May include surrounding context.

Send SMS

bash

curl -X POST http://IP:8080/message \
  -u username:password \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This shell script performs a safety-sensitive external action by sending SMS messages to multiple recipients over the network, but the non-dry-run path proceeds directly from a brief status log to transmission. Although the script documents usage and provides a dry-run mode, it does not include an explicit confirmation prompt or warning immediately before the irreversible send operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This code transmits user-supplied message content and recipient phone numbers to an external SMS gateway over HTTP(S), which is the intended function of the skill but still constitutes real exfiltration of potentially sensitive data. In this skill's context, the danger is elevated because security teams may send incident-related alerts, phone lists, or sensitive operational messages, and the script does not restrict destinations or validate the trust boundary of the configured gateway.

Content

Scanner excerpt · scripts/bulk_sms_capcom6.sh (reported line 314)May include surrounding context.

sh

local response
    local http_code
    
    response=$(curl -s -w "\n%{http_code}" \
        -X POST "$url" \
        -u "${GATEWAY_USER}:${GATEWAY_PASS}" \
        -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Like the multi-recipient path, the single-recipient fallback sends message text and phone numbers to an external gateway, creating an outbound data transmission channel. Although this is expected behavior for an SMS gateway script, it is still security-relevant because misuse, misconfiguration, or attacker-controlled inputs could cause disclosure of sensitive content or abuse of the SMS service.

Content

Scanner excerpt · scripts/bulk_sms_capcom6.sh (reported line 347)May include surrounding context.

sh

local response
    local http_code
    
    response=$(curl -s -w "\n%{http_code}" \
        -X POST "$url" \
        -u "${GATEWAY_USER}:${GATEWAY_PASS}" \
        -H "Content-Type: application/json" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script can send real SMS messages to many recipients immediately once invoked, with no confirmation prompt, recipient summary acknowledgement, or safety interlock beyond an optional dry-run flag. In a security-team automation context, this increases the risk of accidental mass messaging, operational disruption, and unintended disclosure to external phone numbers if inputs or invocation parameters are wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads username and password from environment variables or config and then sends them via curl basic authentication, but there is no user-facing warning in comments, help text, or runtime output about credential use or transmission. Because this is a code file handling sensitive credentials and making a network request, the lack of disclosure matches the missing-warning criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/capcom6_reference.md (reported line 24)May include surrounding context.

md

# Set default URL based on mode
    if [[ "$SERVER_MODE" == "cloud" ]]; then
        GATEWAY_URL="https://api.sms-gate.app/3rdparty/v1"
        log_verbose "Using cloud server mode"
    fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bulk_sms_capcom6.sh (reported line 214)May include surrounding context.

sh

# Set default URL based on mode
    if [[ "$SERVER_MODE" == "cloud" ]]; then
        GATEWAY_URL="https://api.sms-gate.app/3rdparty/v1"
        log_verbose "Using cloud server mode"
    fi

Static analysis

No suspicious patterns detected.