Security audit
Security checks for vulnerabilities and agentic risk
This looks like a real 163/126/yeah.net email client, but it needs review because it can use stored email credentials to send messages and arbitrary local attachments without a built-in confirmation step.
Install only if you are comfortable giving this skill access to a 163/126/yeah.net mailbox authorization code. Before using send or --attach, verify the recipient, message body, and every attachment path yourself; avoid attaching secrets or private files unless you explicitly intend to email them.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Only reads IMAP/SMTP server settings and credentials.
"""
if env_path is None:
env_path = os.path.expanduser("~/.openclaw/email-monitor/.env")
config = {}
if not os.path.exists(env_path):
The skill describes capabilities that read local credential files and connect to external IMAP/SMTP servers, but it does not declare any tool scope or permissions boundary. This creates a mismatch between documented behavior and effective capability, which can lead to unintended file access and network transmission without clear review or user consent.
The activation text is broad enough to match common requests like checking email, reading mail, sending email, or monitoring an inbox, which raises the chance of accidental invocation. In a skill that accesses stored credentials and external mailboxes, overbroad triggering can expose sensitive email content or send messages when the user did not intend to use this specific integration.
The usage section instructs users to send email content and attachments to external SMTP/IMAP services but does not clearly warn that message bodies, search queries, and attachments will be transmitted to third-party mail servers. Without an explicit disclosure, users may unknowingly expose sensitive data during normal use.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
config = {}
if not os.path.exists(env_path):
print(f"Error: Configuration file not found: {env_path}")
print("Please create the file with your email settings.")
sys.exit(1)
try:
The code can transmit email and attachments immediately once arguments are supplied, with no interactive confirmation, dry-run preview, or policy gate. In an agent context, this creates a meaningful risk of unauthorized outbound communication and data exfiltration, especially when combined with arbitrary attachment reads.
The send command accepts arbitrary filesystem paths in --attach and reads them directly, allowing the skill to exfiltrate any local file the invoking agent can access. In an agent setting, this is more dangerous than a normal CLI mail client because a prompt or workflow could cause unintended disclosure of secrets, SSH keys, config files, or user documents via email.