Proton Bridge Email

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6730907f535d3886233dee6679d09943a6b879d5dbd501af22424fbe0afd30df
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its handling of sensitive credentials and execution of external commands. The `scripts/send_email.py` script decrypts `PROTON_BRIDGE_PASS` and other sensitive environment variables from `~/clawd/secrets/proton.env.age` using an `age` identity key from `~/.config/age/keys.txt` via `subprocess.check_output(['age', '-d', ...])`. While this is central to the skill's stated purpose of sending emails via Proton Mail Bridge, the direct decryption and use of sensitive credentials, combined with external command execution, represents a high-risk capability. There is no clear evidence of intentional malicious behavior like exfiltration to unauthorized endpoints, but the inherent risk of handling secrets in this manner warrants a 'suspicious' classification.