ClawMail

• Analyzed: May 14, 2026, 3:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: debbb8f20c2010c2a72c84520c02c547168cac9e1bf5b652ab4a784cb80bae19
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for ClawMail appears benign. All network interactions are directed to the declared `api.clawmail.to` domain, and the `skill.md` documentation includes explicit 'CRITICAL SECURITY WARNING' instructions to the agent to prevent API key exfiltration to other domains. While the skill involves network communication and handling API keys, these actions are directly aligned with its stated purpose of providing email infrastructure for AI agents. There is no evidence of malicious execution, data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior.