Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Outlook
v0.1.0Outlook / Microsoft mail integration via Maton managed OAuth and Microsoft Graph-compatible gateway. Use when users want to read, search, summarize, draft, s...
⭐ 0· 33·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md and bundled scripts consistently call Maton gateway endpoints (gateway.maton.ai and ctrl.maton.ai) and implement Microsoft Graph-style requests; these align with the stated Outlook integration purpose. However, the registry metadata lists no required environment variables or primary credential while SKILL.md and both scripts require MATON_API_KEY — this mismatch is unexpected and noteworthy.
Instruction Scope
Runtime instructions and scripts are narrowly scoped to mailbox operations via the Maton gateway (list, read, search, draft, send, patch, move, delete). They do not instruct reading local files or other environment variables, and write operations are explicitly gated behind confirmation guidance in the docs.
Install Mechanism
This is an instruction-only skill with no install spec and no network-based installer. Two small Python helper scripts are included; there are no downloads, archives, or non-standard install actions.
Credentials
The code and SKILL.md require a single secret (MATON_API_KEY) to authenticate to Maton. That is proportionate for an API gateway integration. However, the published registry metadata does not declare this required environment variable/primary credential — an inconsistency that could lead to accidental credential exposure or misconfiguration. Confirm the required MATON_API_KEY before installing and ensure its scope is limited.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request persistent or elevated agent/system privileges and does not modify other skills or system configs. Autonomous invocation is allowed (platform default) but not combined with other high-risk flags.
What to consider before installing
This skill's code and documentation are coherent: it talks to Maton's Outlook gateway and both helper scripts only use the MATON_API_KEY and make HTTPS requests to gateway.maton.ai/ctrl.maton.ai. However, the registry metadata incorrectly omits the required MATON_API_KEY/primary credential — verify that you will need to provide a Maton API key and that you trust maton.ai and the skill publisher before installing. Confirm the MATON_API_KEY has limited scope (only mailbox access) and rotate/revoke it if you later uninstall the skill. Because the skill can send mail, be careful with automatic sends: follow the SKILL.md guidance to require explicit confirmation before any write/send action. If you need higher assurance, ask the publisher why the manifest omits the env var and request a validated package origin or official homepage for Maton.Like a lobster shell, security has layers — review code before you run it.
latestvk972t7qxq5yqjrk510j67yc411844k5m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.