Gmail Link Archiver
v1.1.0Connects to Gmail via IMAP, filters emails by subject prefix keyword in a specified mailbox, crawls links found in filtered emails using Playwright (to bypas...
⭐ 0· 62·1 current·1 all-time
by목진왕@jinwangmok
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (archive links from Gmail via IMAP and crawl them with Playwright) matches the included files and declared requirements: python3, a setup script that installs Playwright/html2text, and a Python script that logs into IMAP, extracts links, crawls pages, converts to Markdown, and saves files. No unrelated binaries or credentials are requested.
Instruction Scope
SKILL.md and the Python code instruct the agent to collect Gmail IMAP credentials (App Password), read mailboxes, extract links, and open those links in headless Chromium via Playwright. That is within the described scope, but crawling executes remote JavaScript and network requests for each link — a powerful capability that can fetch third-party resources and run remote code in a headless browser, which is expected but potentially impactful.
Install Mechanism
No packaged install spec in registry; installation is via the provided setup.sh which creates a virtualenv and uses pip to install playwright and html2text, then runs 'playwright install chromium' to download browser binaries. This is a standard approach for Playwright but involves downloading and installing browser binaries (network action). The install sources are normal PyPI/playwright tooling and not an arbitrary unknown URL.
Credentials
The skill asks the user for an IMAP host, account, and an App Password (2FA App Password). Those are proportionate to Gmail IMAP access. The script saves credentials in plaintext JSON at ~/.config/gmail-link-archiver/config.json (file mode 0600). Storing an app-specific password locally is convenient but sensitive—no unrelated secrets or system credentials are requested.
Persistence & Privilege
The skill is not marked 'always' and does not attempt to modify other skills or system-wide agent settings. It writes its own config in the user's home config directory and creates a local virtualenv under the references folder for dependencies — expected for a local CLI tool.
Assessment
This skill appears to do what it says, but review these points before installing:
- It requires an IMAP App Password for your Gmail account. Use a Google App Password (not your main account password) and enable 2FA. Consider revoking the App Password when you no longer need the skill.
- Credentials are stored as JSON at ~/.config/gmail-link-archiver/config.json with 0600 permissions. If you prefer, run the script each time without saving or store the config in an encrypted location.
- The crawler opens every extracted link in headless Chromium and executes page JavaScript. That is necessary to capture JS-rendered content but can cause additional network traffic and may load third-party resources. Run in an isolated environment if you are concerned about exposure.
- The setup script creates a Python virtualenv and downloads Playwright and the Chromium binary. Ensure you trust running these standard tools and have sufficient disk/network policy.
- If you want additional assurance, inspect references/gmail_link_archiver.py yourself (it is included) or run it in a sandboxed account/container. Avoid providing your primary Gmail password; use an App Password as instructed.
Overall this skill is internally coherent with its stated purpose; the main residual risks are sensitive local storage of credentials and the expected effects of automated browsing of arbitrary links.Like a lobster shell, security has layers — review code before you run it.
latestvk9701chvtfy9rb02qtrxqn9kqx83p2n5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📬 Clawdis
Binspython3