ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Gmail Litiao

v1.0.0

Gmail API integration with managed OAuth. Read, send, and manage emails, threads, labels, and drafts. Use this skill when users want to interact with Gmail....

⭐ 0· 119·1 current·1 all-time
by@litiao1224
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The name/description claim Gmail API access via managed OAuth and the SKILL.md exclusively documents calling Maton endpoints (gateway.maton.ai, ctrl.maton.ai, connect.maton.ai) using MATON_API_KEY. Requiring a Maton API key is proportionate to that stated purpose. However, repository/packaging metadata (_meta.json) and registry metadata differ (different ownerId, slug and version numbers), and the source/homepage are unknown — this mismatch is a packaging/attribution concern that should be checked.
✓
Instruction Scope
SKILL.md contains only examples and instructions to call the Maton gateway and control endpoints using the MATON_API_KEY and to complete OAuth via a returned URL. It does not instruct the agent to read arbitrary local files, unrelated env vars, or transmit data to unexpected domains beyond the Maton service and Google's proxied API endpoints.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files for execution. That minimizes filesystem/write risk; nothing is downloaded or installed by the skill itself.
ℹ
Credentials
Only one environment variable is required (MATON_API_KEY), which is coherent for a proxied OAuth gateway. Be aware that this single key likely enables the Maton service to access your Google connections and act on your behalf (read/send email, manage labels/drafts). The sensitivity of that single variable is therefore high and should be treated accordingly.
✓
Persistence & Privilege
The skill does not request always:true and does not include install-time behavior that modifies other skills or system-wide config. The agent may invoke the skill autonomously (default), which is expected behavior but worth noting because the MATON_API_KEY would be used whenever the skill is invoked.
Assessment
This skill appears to do what it says: it routes Gmail API calls through Maton's gateway and requires a MATON_API_KEY. Before installing, verify the Maton service and domain (maton.ai) are trustworthy and that you expect a third party to be able to exchange OAuth tokens for your Gmail account. Check the OAuth scopes that will be requested when you open the connect URL, and prefer least-privilege scopes. Investigate the metadata mismatch (_meta.json ownerId/slug/version differ from registry metadata) and confirm the publisher identity if that matters to you. Keep MATON_API_KEY secret, consider using a dedicated account or limited-scope credentials for automation, and limit agent permissions or disable autonomous invocation if you do not want the agent to call this skill without explicit approval.

Like a lobster shell, security has layers — review code before you run it.

latestvk978s81xjdncqjvc5qx65nns95832cn2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🧠 Clawdis
EnvMATON_API_KEY

Comments