Snail Mail
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent local inbox skill that stores messages in a workspace file and shows no evidence of network access, credential use, or hidden behavior.
Before installing, be comfortable with the agent creating and updating a local plain-JSON inbox file. Do not store secrets in messages unless that local persistence is acceptable, and verify OPENCLAW_WORKSPACE points where you expect.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Important notes, links, and potentially sensitive event details can remain on disk and be shown again in later inbox renders.
The skill deliberately persists inbox entries locally and may fall back to the home directory if the workspace variable is absent.
Messages stored in `{workspace}/inbox/messages.json`... `OPENCLAW_WORKSPACE` — base directory for inbox storage (defaults to `$HOME`)Use it only if you want persistent local message storage; avoid placing secrets in inbox messages and periodically review or archive the inbox.