Smart Email
WarnAudited by ClawScan on May 18, 2026.
Overview
The skill’s email-reading purpose is coherent, but it misleadingly claims local-only encrypted handling while sending email content to an AI provider and storing mailbox secrets without evident encryption.
Install only if you are comfortable granting mailbox read access, storing app passwords/OAuth tokens under the skill directory, and sending email contents to the configured AI provider for summaries. Prefer revocable app passwords or OAuth, restrict access to the data directory, choose a trusted AI endpoint, and avoid custom IMAP on untrusted networks until TLS validation is fixed.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users may grant mailbox access believing their email data and credentials never leave the machine and are encrypted locally.
The documentation promises encrypted local-only storage, but the code stores mailbox secrets in plain SQLite columns and sends email text to an AI API for summaries.
- 邮箱凭证：`<SKILL_DIR>/data/email.db`（SQLite，本地加密存储） ... - 所有数据仅存在用户本地，不上传
Correct the documentation and metadata, make third-party AI upload explicit before summarizing, and implement real encrypted or OS-keychain-backed secret storage.
Private email contents may be sent to a third-party AI provider whenever summaries or digests are requested.
Sender, subject, and email body are included in the prompt and posted to the configured chat-completions provider, whose default base is DeepSeek.
const prompt = `... 发件人: ${from} ... 主题: ${subject} ... 正文:\n${body || '(无法读取正文)'}`; ... fetch(`${api.base}/chat/completions`, ... messages: [{ role: 'user', content: prompt }])Use only a trusted AI endpoint, make summarization opt-in with explicit disclosure, or configure a local/self-hosted model if email contents must remain local.
Anyone or any process that can read the skill’s data directory could potentially obtain mailbox credentials or long-lived OAuth refresh tokens.
Mailbox app passwords and OAuth access/refresh tokens are persisted directly in the SQLite database with no encryption or OS credential-store use visible in the artifact.
CREATE TABLE IF NOT EXISTS accounts (... password TEXT, ... access_token TEXT, refresh_token TEXT, token_expires INTEGER ...);
Store secrets in the operating system keychain or encrypt them with user-controlled keys; advise users to use revocable app passwords/OAuth and protect the data directory.
On untrusted networks or with a spoofed mail server, custom-mail users could have passwords or email content intercepted.
For custom IMAP providers, TLS certificate validation is disabled while mailbox credentials and email content are transmitted.
tls: { rejectUnauthorized: emailType === 'custom' ? false : true }Verify TLS certificates by default for all IMAP servers; require an explicit, clearly warned opt-out for unusual custom servers.
Setup may run third-party npm install code on the user’s machine.
Installing dependencies can execute a native package install/build script for SQLite support; this is expected for the dependency and lockfile-pinned, but still supply-chain-sensitive.
"node_modules/better-sqlite3": { ... "hasInstallScript": true ... }Install from a trusted registry/source, keep the lockfile intact, and review dependency updates before upgrading.