Android `service` command - how to use compound types as arguments?

I'm trying to automate replies to a group MMS with Tasker. So far, I've been able to write a couple shell scripts with Termux that can poke into the SQLite database where received messages are stored, and get the content of those messages and the numbers of the participants in that conversation.

However, Tasker has no way to send MMS messages built in. The one lead that I've had so far has been this StackOverflow answer, which suggests using the service utility (source code here) to call the internal MMS service directly.

I'm running Android 9, so this should be the correct IMms.aidl interface. I've determined that I want to call the following method, which should be method #1:

void sendMessage(int subId, String callingPkg, in Uri contentUri,
        String locationUrl, in Bundle configOverrides, in PendingIntent sentIntent);

However, there is a problem here: contentUri is a URI object, which is not one of the primitives that the service utility can actually send. I've tried a couple different ways to get it to work, but it almost seems like it's impossible to do with just the service utility.

If I try to call it with the wrong object type anyways, I get the following result:

:/data/data/com.termux/files/home # service call imms 1 i32 0 s16 "com.android.mms.service" s16 "+15717585263"
Result: Parcel(
  0x00000000: fffffffd 00000019 006e0055 006e006b '........U.n.k.n.'
  0x00000010: 0077006f 0020006e 00520055 00200049 'o.w.n. .U.R.I. .'
  0x00000020: 00790074 00650070 0020003a 00320033 't.y.p.e.:. .3.2.'
  0x00000030: 00310031 00300033 00000037 000001d8 '1.1.3.0.7.......'
  0x00000040: 000000e6 00610009 00200074 006e0061 '......a.t. .a.n.'
  0x00000050: 00720064 0069006f 002e0064 0065006e 'd.r.o.i.d...n.e.'
  0x00000060: 002e0074 00720055 00240069 002e0031 't...U.r.i.$.1...'
  0x00000070: 00720063 00610065 00650074 00720046 'c.r.e.a.t.e.F.r.'
  0x00000080: 006d006f 00610050 00630072 006c0065 'o.m.P.a.r.c.e.l.'
  0x00000090: 00550028 00690072 006a002e 00760061 '(.U.r.i...j.a.v.'
  0x000000a0: 003a0061 00380031 00330030 000a0029 'a.:.1.8.0.3.)...'
  0x000000b0: 00610009 00200074 006e0061 00720064 '..a.t. .a.n.d.r.'
  0x000000c0: 0069006f 002e0064 0065006e 002e0074 'o.i.d...n.e.t...'
  0x000000d0: 00720055 00240069 002e0031 00720063 'U.r.i.$.1...c.r.'
  0x000000e0: 00610065 00650074 00720046 006d006f 'e.a.t.e.F.r.o.m.'
  0x000000f0: 00610050 00630072 006c0065 00550028 'P.a.r.c.e.l.(.U.'
  0x00000100: 00690072 006a002e 00760061 003a0061 'r.i...j.a.v.a.:.'
  0x00000110: 00370031 00320039 000a0029 00610009 '1.7.9.2.).....a.'
  0x00000120: 00200074 006f0063 002e006d 006e0061 't. .c.o.m...a.n.'
  0x00000130: 00720064 0069006f 002e0064 006e0069 'd.r.o.i.d...i.n.'
  0x00000140: 00650074 006e0072 006c0061 0074002e 't.e.r.n.a.l...t.'
  0x00000150: 006c0065 00700065 006f0068 0079006e 'e.l.e.p.h.o.n.y.'
  0x00000160: 0049002e 006d004d 00240073 00740053 '..I.M.m.s.$.S.t.'
  0x00000170: 00620075 006f002e 0054006e 00610072 'u.b...o.n.T.r.a.'
  0x00000180: 0073006e 00630061 00280074 004d0049 'n.s.a.c.t.(.I.M.'
  0x00000190: 0073006d 006a002e 00760061 003a0061 'm.s...j.a.v.a.:.'
  0x000001a0: 00380035 000a0029 00610009 00200074 '5.8.).....a.t. .'
  0x000001b0: 006e0061 00720064 0069006f 002e0064 'a.n.d.r.o.i.d...'
  0x000001c0: 0073006f 0042002e 006e0069 00650064 'o.s...B.i.n.d.e.'
  0x000001d0: 002e0072 00780065 00630065 00720054 'r...e.x.e.c.T.r.'
  0x000001e0: 006e0061 00610073 00740063 00420028 'a.n.s.a.c.t.(.B.'
  0x000001f0: 006e0069 00650064 002e0072 0061006a 'i.n.d.e.r...j.a.'
  0x00000200: 00610076 0037003a 00310033 000a0029 'v.a.:.7.3.1.)...'
  0x00000210: 00000000                            '....            ')

Changing the first few characters in the string changes the URI type in the output. I poked around the source for Uri, which suggests that the format for a StringUri is something along the lines of (i32 1, s16 "<uri>"). However, this still doesn't help, because service is only able to write UTF-16 strings into the "parcel" (which I assume is the name of the binary format that's being sent over some kind of internal socket).

Is there any way to do this with the service utility? If not, can I just write bytes into some internal system socket? Failing both of those, would there be any other way to send an MMS to a list of recipients without requiring the phone to be unlocked?

(if this belongs somewhere other than StackOverflow, please move it / tell me so I can move it)