ClawHub
Code Pluginsource linked

Kudosity SMSv1.0.0

Kudosity SMS channel plugin for OpenClaw

kudosity-openclaw-sms·runtime kudosity-sms·by @t--becker
Community code plugin. Review compatibility and verification before install.
openclaw plugins install clawhub:kudosity-openclaw-sms
Latest release: v1.0.0Download zip

Capabilities

Tags
executes-codechannel:kudosity-sms
Channels
kudosity-sms
configSchema
Yes
Executes code
Yes
HTTP routes
0
Runtime ID
kudosity-sms

Compatibility

Built With Open Claw Version
2026.4.26
Min Gateway Version
2026.3.30
Plugin Api Range
>=2026.3.30
Plugin Sdk Version
2026.4.26
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The code, README, and SKILL.md consistently implement a Kudosity SMS channel (sending SMS via Kudosity API, webhook helpers, setup wizard). That capability legitimately needs an API key and sender number. However, the registry metadata lists no required env vars/primary credential even though SKILL.md and the code rely on KUDOSITY_API_KEY and KUDOSITY_SENDER as a runtime fallback — a mismatch between declared registry requirements and actual needs.
✓
Instruction Scope
The SKILL.md instructs only on installing the plugin, configuring an API key and sender, and using the channel. Runtime instructions and the code operate only against the Kudosity API and configuration/environment variables; they do not instruct reading unrelated files or exfiltrating arbitrary data.
ℹ
Install Mechanism
No external download-from-URL or installer script is present (package.json and source are included and the plugin is expected to be installed via OpenClaw's plugin system / npm). However, the registry summary labels this as 'instruction-only' with no install spec while the package contains full source and a package.json — an administrative inconsistency that could confuse reviewers or automated gating.
!
Credentials
The plugin legitimately needs a Kudosity API key and sender number to function. Those env vars are used as fallbacks (process.env.KUDOSITY_API_KEY, process.env.KUDOSITY_SENDER) and SKILL.md states both must be set together. The registry metadata, however, does not declare these required env vars or a primary credential, which is an omission that reduces transparency and could lead users to unintentionally expose or misconfigure credentials.
✓
Persistence & Privilege
The plugin does not request always: true and does not attempt to modify other plugins or system-wide settings. The setup wizard writes credentials to the agent config, which is normal for channel plugins. The plugin can be invoked autonomously by the agent (platform default) but that is expected for channels.
What to consider before installing
What to check before installing: - Expect to provide a Kudosity API key and a sender phone number (KUDOSITY_API_KEY and KUDOSITY_SENDER are used as env fallbacks). The registry metadata did not declare these env vars — verify and supply them via config or env when you install. - The package contains code and a package.json and is intended to be installed via OpenClaw's plugin installer/npm; there is no arbitrary external download URL in the manifest. - Review and store the API key securely (use least-privilege/rotate keys) — the key can send SMS (which may be billable) so treat it like a secret. - The plugin uses OpenClaw's SSRF-guarded fetch (fetchWithSsrFGuard), which is better than raw fetch, but you should still install from the official source (kudosity/openclaw-sms) and confirm the package integrity (e.g., trusted registry, checksums) before enabling in production. - If you plan an env-only deployment, remember to enable the plugin in your OpenClaw config (plugins.entries["kudosity-sms"].enabled: true) so the runtime picks it up. - If you want stronger assurance, review the source files included (kudosity-api.ts, channel.ts, etc.) to confirm there is no unexpected network or filesystem access beyond the Kudosity API and configuration. If you need me to, I can highlight any specific lines of code that access process.env or make network calls.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Source
github.com/kudosity/openclaw-sms
Commit
0cec6d9c1bfa
Tag
main
Provenance
No
Scan status
pending

Tags

latest
1.0.0

kudosity-openclaw-sms

Cloud SMS channel plugin for OpenClaw, powered by the Kudosity v2 API. Send and receive SMS from your OpenClaw agent with a real Australian (or international) sender number, no app required on the recipient's phone.

Install

openclaw plugins install kudosity-openclaw-sms
openclaw gateway restart

OpenClaw checks ClawHub first and falls back to npm automatically.

Configure

You can configure the plugin two ways: through the interactive setup wizard or by editing your config file directly.

Interactive (recommended)

openclaw setup

Pick SMS Kudosity from the channel list. The wizard asks for your API key (validated live against the Kudosity API) and your sender number, then writes the credentials into your config.

Manual

{
  plugins: {
    entries: {
      "kudosity-sms": { enabled: true },
    },
  },
  channels: {
    "kudosity-sms": {
      apiKey: "your-kudosity-api-key", // pragma: allowlist secret
      sender: "+61400000000",
    },
  },
}

Environment variables

KUDOSITY_API_KEY and KUDOSITY_SENDER are read at runtime as a fallback when the corresponding config keys are absent. Both variables must be set together.

⚠️ Env-only deployments: unlike the bundled OpenClaw channels, an external plugin cannot register its env-var prefix with core's plugin-auto-enable. If you want to ship credentials only via env, you still need plugins.entries["kudosity-sms"].enabled: true in your config so the plugin loader picks the channel up at startup. The runtime credential resolution itself works from env vars without any config-file presence.

Capabilities

FeatureSupported
Text messages✅
Media / MMS❌ (degrades to caption text)
Threads❌
Groups❌
Reactions❌
Streaming❌ (block-streaming on — one SMS per final reply)

The 1,600-character text chunk limit (10 concatenated SMS segments) is applied automatically; longer agent replies are split across multiple sends.

Sending a message

openclaw send --channel kudosity-sms --to +61478038915 --text "hello from openclaw"

Get an API key + sender number

  1. Sign up at kudosity.com/signup (free trial available).
  2. Settings → API Keys → Create Key for the API key.
  3. Numbers → Lease a virtual number for the sender, or use a number you already own.

API docs: https://developers.kudosity.com

Webhook utilities

The plugin exports parsing helpers for inbound SMS webhooks (parseWebhookPayload, toInboundMessage, handleWebhookRequest) for use by integrators who want to wire inbound delivery themselves. Built-in gateway-route registration is not included in v1.0.0 — it is on the roadmap.

Troubleshooting

SymptomLikely cause
openclaw plugins list does not show kudosity-smsRestart the gateway after install: openclaw gateway restart
Plugin shows but channel is missing in openclaw setupAdd plugins.entries["kudosity-sms"].enabled: true to your config
Kudosity API error (401)API key is invalid or revoked. Generate a new one in the Kudosity dashboard
Kudosity SMS: invalid phone number formatSender or recipient is not E.164. Use the leading + and digits only

Issues

Open an issue at https://github.com/kudosity/openclaw-sms/issues.

License

MIT — see LICENSE.