ClawHub
Back to skill

Security audit

Sending SMS

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward SMS-sending guide with real messaging and cost risks that are disclosed and aligned with its purpose.

Use sandbox keys first. Before any live send, confirm the recipient numbers, message content, message type, consent/compliance status, and expected charges, especially for marketing, scheduled, or batch messages. Keep the Sendly API key out of prompts, logs, and shared files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents live production SMS sending and notes that live keys send real messages, but it does not prominently warn about user consent, recipient impact, and billing before showing actionable commands. In an agent context, this can lead to unauthorized outbound messaging, spam, privacy issues, and unexpected charges if invoked without an explicit confirmation step.

Static analysis

No suspicious patterns detected.