Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Sendly SMS API guide, with real-message and cost risks that are disclosed and aligned with its purpose.
Install only if you intend to use Sendly for SMS. Use sk_test_* keys while testing, confirm recipients and message type before any live send, and be especially careful with batch sends because they can contact many people and incur charges.
The description says the skill 'Applies when sending text messages, notifications, alerts, or reminders via SMS,' which is a wide, generic trigger scope without clear constraints or exclusion conditions. In a markdown skill file, this can cause unintended invocation because many common tasks could be interpreted as fitting this description.
The authentication section notes that live keys send real SMS on verified numbers, but it does not provide a prominent operational warning near the executable production examples that those examples can trigger billable outbound messages. In an agent-skill context, that increases the risk of unintended real-world actions, costs, and unauthorized messaging if the skill is invoked with live credentials.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://sendly.live/api/v1/messages \
-H "Authorization: Bearer $SENDLY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"to": "+15551234567", "text": "Hello!", "messageType": "transactional"}'