Voipms Sms

OpenClaw skill for sending and retrieving SMS messages via the VoIP.ms API (no Bitwarden dependency).

Security Scan

The skill's code, declared environment variables, and runtime instructions are consistent with its stated purpose of sending and retrieving SMS via the VoIP.ms API.

Purpose & Capability

Name/description, openclaw.json, SKILL.md, and the included Python scripts all align: they implement send/get SMS via the VoIP.ms REST API and require only VoIP.ms API username/password.

Instruction Scope

SKILL.md limits runtime actions to running the two included scripts. The scripts only contact the declared VoIP.ms API endpoint and print the responses. Note: the scripts send credentials as URL query parameters (GET) which may be recorded in transit logs or server access logs — functionally consistent with the skill but a potential operational privacy concern.

Install Mechanism

No install spec; this is instruction-only with bundled Python scripts. Nothing is downloaded from external URLs during install.

Credentials

The skill requests exactly VOIPMS_API_USERNAME and VOIPMS_API_PASSWORD — appropriate and declared. However, those credentials are embedded in GET query parameters by the scripts, which increases the chance they appear in logs or intermediate proxies; SKILL.md correctly recommends using a sub-account with limited permissions.

Persistence & Privilege

always is false, the skill is user-invocable and does not request persistent system presence or modify other skills/config. Autonomous model invocation is enabled (platform default) but not combined with other concerning privileges.

Assessment

This skill appears to do what it claims: it uses the VoIP.ms API and only needs your VoIP.ms API username/password. Before installing, consider: 1) The source and homepage are unknown — if you don't trust the publisher, review the two Python scripts yourself (they are short and included). 2) The scripts put API username/password in the URL query string (GET) — this can be recorded in server logs or by intermediate proxies; prefer a dedicated sub-account as suggested or an API token/mechanism that avoids embedding credentials in URLs. 3) Store credentials in a secure place (not a long-lived shared shell session) and rotate/revoke the sub-account credentials if you stop using the skill. If you want higher assurance, ask the publisher for a provenance URL or an official homepage/source repository.

VoIP.ms SMS Skill

Use this skill to send and retrieve SMS messages through the VoIP.ms API.

Available Scripts

scripts/send_sms.py

Send an SMS from one of your VoIP.ms DIDs to a destination number.

Required arguments:

• --did: source VoIP.ms number
• --dst: destination phone number
• --message: SMS message text

Example:

python3 scripts/send_sms.py \
  --did "15551234567" \
  --dst "15557654321" \
  --message "Hello from OpenClaw"

scripts/get_sms.py

Retrieve SMS messages from the VoIP.ms API for a recent date range.

Arguments:

• --did (optional): filter by a specific source number
• --days (optional, default 1): number of days back to fetch

Example (all numbers, last day):

python3 scripts/get_sms.py --days 1

Example (specific DID, last 7 days):

python3 scripts/get_sms.py --did "15551234567" --days 7

Required Credentials

Set these environment variables before running either script. The Python scripts will read them directly. Please create a sub-account/dedicated VoIP.ms API account that only has SMS permissions rather than using your main admin credentials.

Example:

export VOIPMS_API_USERNAME="my_api_username"
export VOIPMS_API_PASSWORD="my_api_password"