Unified Mailbox Ai

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.1.0

Overview

This skill appears intended to monitor email, but it gives automated AI workflows broad mailbox/calendar access and ongoing Telegram notification authority that users should review carefully before installing.

Install only if you are comfortable with an automated agent reading configured Outlook/Gmail mail and calendars, sending summaries to Telegram, and running on a schedule. Review the OAuth scopes, avoid broad write/send permissions if possible, be cautious with ~/.bashrc and cron defaults, and use this only on accounts where external AI processing and Telegram delivery are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

Emails:
{email_summary}"""

    result = subprocess.run([
        OPENCLAW_BIN, 'agent',
        '--message', message,
        '--deliver',

• Confidence: 91% confidence
• Finding: The code invokes an external agent binary with a prompt built from untrusted email content and environment-derived values, delegating further actions such as reading message bodies, checking calendars, and sending Telegram messages. Even though subprocess is called without shell=True, this still creates a prompt-injection and unintended-action path because adversarial email text can influence the downstream agent to perform extra actions or exfiltrate data.

Tainted flow: 'message' from os.environ.get (line 313, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

Emails:
{email_summary}"""

    result = subprocess.run([
        OPENCLAW_BIN, 'agent',
        '--message', message,
        '--deliver',

• Confidence: 94% confidence
• Finding: The message sent to the external agent is tainted by environment values and, more importantly, by untrusted email subjects/previews serialized into the prompt. This is dangerous because the receiving agent is explicitly instructed to perform actions, so attacker-controlled email content can manipulate the agent into executing unintended mailbox/calendar operations or leaking data to Telegram.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares only tools, but its documented behavior clearly involves sensitive capabilities including environment access, file writes, shell execution, and external network communication to email, calendar, and Telegram services. This mismatch weakens review and consent boundaries because users and orchestrators may underestimate what the skill can do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is mailbox monitoring, but the finding indicates additional persistence and system-modifying behaviors such as editing ~/.bashrc, updating ~/.openclaw/openclaw.json, registering across agents, and installing a cron job. Those actions exceed normal mailbox-checking scope and create stealthy persistence, broader execution surface, and lasting configuration changes without clear disclosure or consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The installer modifies every agent entry in openclaw.json to add the skill, which is a persistent configuration change beyond simply installing files. Although the script prompts first, this broad registration affects all agents rather than a clearly selected target and can unexpectedly expand the skill’s reach and access surface.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The installer offers to install a cron job that runs the mailbox script every 5 minutes, creating persistent autonomous execution. For a skill that reads mail and sends Telegram notifications, this materially changes risk because it enables unattended background access to sensitive communications on an ongoing basis.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill requests broad Outlook scopes including Mail.ReadWrite, Mail.Send, and Calendars.ReadWrite despite primarily presenting as a monitoring/summarization tool. Excess privileges increase blast radius if the script, token cache, or downstream agent is abused, enabling mailbox modification, mail sending, and calendar changes.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script dynamically locates and executes a generalized openclaw agent binary rather than a narrowly scoped helper for mailbox summarization. In this context, a tool-capable agent materially expands what untrusted email content can cause the system to do, especially because the prompt includes operational instructions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code instructs the external agent to fetch Gmail bodies, inspect calendars, and mark emails as notified, which goes beyond passive summarization and notification. Because these actions are delegated through a prompt that embeds attacker-controlled email data, the capability expansion significantly increases risk of unauthorized data access and state changes.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: A broad activation phrase like 'check/monitor email from either or both accounts' can cause the skill to run in situations where the user did not intend cross-account access or notification behavior. In a skill that reads mailbox contents and may send Telegram messages, accidental invocation increases privacy and data-exposure risk.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The 'When to Use' section contains vague triggers like cron-based monitoring and meeting/calendar questions, which may cause autonomous execution beyond a user's immediate request. Because the skill accesses private emails and calendars and can notify via Telegram, ambiguous triggers raise the chance of over-collection and unintended disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description omits a clear warning that email-derived content may be sent to Telegram, an external messaging platform. Since emails can contain sensitive personal, financial, or corporate information, summarizing or forwarding content without prominent disclosure creates a significant confidentiality risk.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The installer writes user-provided identifiers like Telegram chat ID and Gmail account into openclaw.json and optionally into ~/.bashrc without an explicit warning about persistence, visibility to local users/processes, or privacy implications. This is not an exploit by itself, but it unnecessarily increases exposure of personal identifiers and makes the system state less transparent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script serializes email metadata and previews into a prompt and sends the resulting notification through an external AI/Telegram flow without an explicit consent or disclosure checkpoint. This can expose sensitive correspondence details to third-party processing and a messaging channel that may not be appropriate for all mail contents.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The prompt explicitly tells the external agent to fetch full Gmail bodies and include summaries in a Telegram notification, which can disclose private email contents outside the mailbox provider. In a mailbox-monitoring skill, this context makes the issue more dangerous because incoming emails routinely contain secrets, personal data, and business-sensitive information.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- User asks about meeting invitations or calendar conflicts

## Credentials
Accounts are pre-configured via environment variables. **Do not ask the user for credentials. Just run the scripts directly.**

---

• Confidence: 86% confidence
• Finding: The instruction to 'Just run the scripts directly' encourages autonomous use of preconfigured credentials without confirming scope, selected accounts, or whether notifications should be sent. In a mailbox and calendar context, that can lead to actions on sensitive data without adequate user awareness or least-privilege checks.

Session Persistence

Medium

• Category: Rogue Agent

Content

description: Unified mailbox AI for both Outlook and Gmail. Checks unread emails, summarizes new mail with AI, detects meeting invitations, checks calendar conflicts on both Outlook and Google Calendar, and sends Telegram notifications. Use when asked to check/monitor email from either or both accounts.
homepage: https://github.com/L1TangDingZhen/email-monitor
license: MIT
allowed-tools: Bash Read Write
metadata: {"openclaw":{"emoji":"📧","requires":{"bins":["python3"],"env":["EMAIL_MONITOR_TELEGRAM_USER"],"optionalBins":["gog"],"optionalEnv":["MS_GRAPH_ACCESS_TOKEN","EMAIL_MONITOR_GMAIL_ACCOUNT"]}}}
---
# Unified Mailbox AI

• Confidence: 72% confidence
• Finding: The skill advertises write capability and the associated findings indicate persistent state/config writes such as notified email records and possibly broader OpenClaw configuration changes. Persistent writes are risky here because they can retain sensitive identifiers, alter future agent behavior, and outlive the current session without clear retention controls.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.