Vonage

Vonage — SMS messaging, voice calls, verify API, number management, and application management.

Security Scan

The skill largely matches its Vonage SMS/voice description, but there are implementation inconsistencies and a few behaviours (undocumented .env fallback, credentials placed in query strings, and some CLI bugs) that merit caution before installing.

Purpose & Capability

Name and description match the code and declared env vars: the script is a CLI for Vonage/Nexmo APIs and only requests VONAGE_API_KEY and VONAGE_API_SECRET, which are appropriate for the stated functionality.

Instruction Scope

The runtime script will read a '.env' file from WORKSPACE or ~/.openclaw/workspace as a fallback if environment variables are missing; this behaviour is not documented in SKILL.md. The script also transmits the API secret as a query parameter (api_secret), which can be logged by intermediaries. Additionally the CLI argument plumbing is buggy (argparse uses dest='from_addr' but handlers inspect getattr(args,'from')), indicating the instructions and code are not perfectly aligned.

Install Mechanism

This is an instruction-only skill with a small Python stdlib script included and no install spec. Nothing is downloaded or written during installation by the registry metadata.

Credentials

Only VONAGE_API_KEY and VONAGE_API_SECRET are required (and primaryEnv is VONAGE_API_KEY), which is proportionate. However the script will look up values in a workspace .env file if env vars are missing, and it sends the secret in query parameters (increasing risk of exposure in logs).

Persistence & Privilege

The skill does not request always:true and does not ask to modify other skills or system-wide config. It will run only when invoked.

What to consider before installing

This skill appears to implement Vonage API calls and only requests the expected API key and secret, but review the code before installing. Pay attention to three points: (1) the script will try to read a .env file under WORKSPACE or ~/.openclaw/workspace if the env vars are not set — avoid storing unrelated secrets there or set the VONAGE_* env vars explicitly; (2) the implementation includes sending the API secret as a URL query parameter (api_secret), which can be captured in logs or proxies — consider whether that is acceptable for your environment; and (3) the CLI contains small bugs (mismatched argument names and duplicated/embedded query strings) that could cause unexpected behavior. If you plan to use this skill, run it in an isolated environment, inspect/modify the script (e.g., move secrets to safer headers, fix argparse handling), and confirm network endpoints are the official Vonage ones. If you need higher assurance, request a version from a known maintainer or a vetted marketplace package.

Vonage — SMS messaging, voice calls, verify API, number management, and application management.

Requirements

Variable	Required	Description
VONAGE_API_KEY	✅	Vonage API key
VONAGE_API_SECRET	✅	Vonage API secret

Quick Start

# Send SMS
python3 {{baseDir}}/scripts/vonage.py send-sms --from <value> --to <value> --text <value>

# Search messages
python3 {{baseDir}}/scripts/vonage.py list-messages --date <value> --to <value>

# Create voice call
python3 {{baseDir}}/scripts/vonage.py create-call --to <value> --from <value> --ncco "JSON"

# List calls
python3 {{baseDir}}/scripts/vonage.py list-calls

# Get call details
python3 {{baseDir}}/scripts/vonage.py get-call <id>

# Send verification code
python3 {{baseDir}}/scripts/vonage.py send-verify --number <value> --brand <value>

# Check verification code
python3 {{baseDir}}/scripts/vonage.py check-verify --request-id <value> --code <value>

# List your numbers
python3 {{baseDir}}/scripts/vonage.py list-numbers

# Search available numbers
python3 {{baseDir}}/scripts/vonage.py search-numbers --country "US" --type "mobile-lvn"

# Buy a number
python3 {{baseDir}}/scripts/vonage.py buy-number --country <value> --msisdn <value>

# List applications
python3 {{baseDir}}/scripts/vonage.py list-applications

# Create application
python3 {{baseDir}}/scripts/vonage.py create-application --name <value>

# Get account balance
python3 {{baseDir}}/scripts/vonage.py get-balance

Output Format

All commands output JSON by default.

Script Reference

Script	Description
{baseDir}/scripts/vonage.py	Main CLI — all commands in one tool

Credits

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation