Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
腾讯企业邮箱/qqexmail
v1.0.0通过 IMAP/SMTP 收发腾讯企业邮箱（exmail.qq.com）邮件。支持发送邮件、收取邮件列表、获取邮件正文。凭证从环境变量读取。
⭐ 0· 45·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (Tencent exmail IMAP/SMTP client) matches the included code (send.js, receive.js, get-body.js) and npm dependencies (imap, mailparser, nodemailer). However the registry metadata claims no required env vars or binaries while the code requires Node.js and two environment variables (EXMAIL_ACCOUNT and EXMAIL_AUTH_CODE). This metadata mismatch is inconsistent and could mislead users about what the skill will access.
Instruction Scope
SKILL.md describes expected behaviour and the code implements sending, listing, and fetching bodies and only connects to exmail.qq.com servers. However: (1) SKILL.md advertises a --days option for receive.js but the receive.js implementation parses --days but does not apply it (unused variable) — a functional mismatch; (2) get-body.js expects a UID from receive.js but uses imap.fetch([uid], ...) without explicitly using UID-mode, which may make fetching by UID unreliable (implementation bug/race); (3) get-body.js uses a fixed short timeout to wait for parsing to finish (racy). There are no calls to unexpected external endpoints, but the code reads sensitive environment variables (as advertised).
Install Mechanism
There is no remote download/install step in the skill package (no URL downloads). The package includes package.json and a package-lock, and SKILL.md instructs to run npm install and node scripts — a standard, low-risk Node.js workflow. Dependencies are common email/parsing libraries from the npm registry (imap, mailparser, nodemailer).
Credentials
The code requires two sensitive environment variables (EXMAIL_ACCOUNT and EXMAIL_AUTH_CODE), which are exactly what an IMAP/SMTP client needs — so the variables themselves are proportionate. The problem is the registry metadata/manifest declares "Required env vars: none" and "Primary credential: none", which is incorrect and misleading. Also note EXMAIL_AUTH_CODE is a highly sensitive credential (email access) — grant only to trusted code and rotate if exposed.
Persistence & Privilege
The skill does not request persistent or elevated platform privileges. always:false and default invocation settings are used. The code does not modify other skills or system-wide settings and does not write persistent credentials to disk. Autonomous agent invocation is enabled by default (not flagged alone), so be cautious about giving an agent email creds as it could send/read mail autonomously.
What to consider before installing
This skill appears to implement the advertised Tencent Exmail IMAP/SMTP features, but there are important caveats: (1) the registry metadata incorrectly claims no required env vars or binaries — the scripts need Node.js and two environment variables (EXMAIL_ACCOUNT and EXMAIL_AUTH_CODE); (2) SKILL.md mentions a --days option but receive.js does not implement it; get-body.js may not reliably fetch by UID due to how the IMAP fetch is called and uses a short timeout — these are functional bugs, not obvious malicious behavior; (3) send.js disables strict TLS verification (tls.rejectUnauthorized: false), which reduces TLS checks (may be needed in some setups but weakens security); (4) EXMAIL_AUTH_CODE grants full mailbox access — do not store it in code or public repos and rotate it if exposed. Before installing: review the code yourself (or have a developer review) and only provide credentials in a controlled environment; prefer running the scripts locally rather than giving these env vars to an autonomous agent you don't fully control. If you plan to trust this skill broadly, ask the author to correct metadata, implement the --days option (or update docs), and address the get-body UID correctness and timeout handling.scripts/get-body.js:4
Environment variable access combined with network send.
scripts/receive.js:4
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk974kzbzwmh3mtqd0yfgrnz9qd83mz62
License
MIT-0
Free to use, modify, and redistribute. No attribution required.