Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gmail Enhanced
v1.0.0Enhanced Gmail integration with advanced features including label management, attachment handling, advanced search, email parsing, and automated email proces...
⭐ 0· 53·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, SKILL.md, and the included python implementation all focus on Gmail operations (search, labels, attachments, send, parsing). Required inputs (OAuth client credentials file and token file) are appropriate for Gmail API access. Note: registry metadata lists no required env vars, while SKILL.md and the code expect GMAIL_CREDENTIALS_PATH / GMAIL_TOKEN_PATH or default files under ~/.credentials — this is a minor metadata mismatch but functionally coherent.
Instruction Scope
SKILL.md instructs the agent to enable Gmail API, create OAuth credentials, and place credentials/token files locally — all within the scope of Gmail integration. The runtime instructions and code confine operations to Gmail APIs and local file paths for credentials/attachments. There are no instructions to read unrelated system files, call external endpoints beyond Google APIs, or exfiltrate data to unknown hosts.
Install Mechanism
No install spec — instruction-only skill with an included Python module. That minimizes install-time risk (nothing downloaded automatically). The code depends on standard google-auth/googleapiclient libraries, which the SKILL.md links to indirectly by describing OAuth setup. No remote or obfuscated install URLs were used.
Credentials
The skill legitimately requires OAuth credentials (client secrets + generated user tokens). Those are sensitive because the declared SCOPES include gmail.readonly, gmail.send, gmail.labels, and gmail.modify (read/write/modify access to the mailbox). This level of access is proportionate for a full-featured Gmail client, but users must understand granting these scopes gives the skill broad mailbox permissions. Also note the registry metadata did not declare required env vars even though SKILL.md/code reference them.
Persistence & Privilege
always is false and default agent invocation behavior is preserved. The skill writes its own token file when authenticating (expected for OAuth) but does not request system-wide configuration changes or other skills' credentials. No permanent elevated presence is requested.
Assessment
This skill appears to do what it says: it uses the Gmail API and requires OAuth client credentials and a user token file. Before installing, consider: (1) OAuth scopes requested include send/modify — installing grants broad mailbox access, so use a dedicated/test account if you want to limit risk; (2) the skill will write tokens.json to the configured path, so protect that file; (3) the package is third‑party and not from a known homepage — review the full source (particularly the parts truncated in this listing), run it in a sandbox, and verify there are no hidden network endpoints; (4) the code contains at least one minor bug/typo in the color mapping (an undefined variable), indicating it may be untested — expect possible runtime errors and consider reviewing or testing before using on production mailboxes.Like a lobster shell, security has layers — review code before you run it.
latestvk9753nehe0debvp4v6mz21mebs83dtsx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.