Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
IMAP SMTP Email
v1.0.4Read and send email via IMAP/SMTP using local Node scripts. Use when the agent needs to check inboxes, fetch email content, search messages, download attachm...
⭐ 0· 98·0 current·0 all-time
byUmbra@mohamed-hammane
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (IMAP/SMTP mail access) matches the actual files and behavior: Node scripts for IMAP reads, attachment parsing, and SMTP sending. Required binaries (node, npm) and the listed IMAP/SMTP environment variables are appropriate for this purpose.
Instruction Scope
SKILL.md and the scripts limit actions to mailbox operations, attachment parsing, contact lookups, and an optional inbox watcher that can forward alerts via the OpenClaw CLI. The watcher uses child_process.execFileSync to call the local OpenClaw CLI (default 'openclaw') to send alerts; this is coherent with the stated feature but means the skill may invoke local CLI/network actions when the watcher runs. The scripts read/write state and contact files under a workspace and enforce path whitelists for attachments; they do not embed unexpected external endpoints.
Install Mechanism
No external download/install script is embedded; dependencies are standard npm packages listed in package.json (imap, nodemailer, mailparser, pdf-parse, xlsx, dotenv). The repo includes a setup helper that runs npm install locally. Nothing in the install flow downloads arbitrary archives from untrusted URLs.
Credentials
The skill legitimately requires IMAP/SMTP credentials. However, the SKILL.md and scripts also rely on additional environment variables and files not listed in the registry metadata (ALLOWED_READ_DIRS, ALLOWED_WRITE_DIRS, EMAIL_ENV_FILE, EMAIL_CONTACTS_FILE, OPENCLAW_WORKSPACE). The credential file is plaintext and contains passwords; the skill recommends storing it at ~/.openclaw/credentials/imap-smtp-mail.env and uses dotenv. This is expected but means you should protect file permissions and prefer app-specific passwords where supported.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It writes a local state file under the workspace and may call the OpenClaw CLI to forward alerts; it does not modify other skills or system-wide settings. Autonomous invocation is permitted by platform default, which simply enables the watcher feature to run if invoked.
Assessment
This appears to be a genuine IMAP/SMTP helper. Before installing: 1) Be aware it requires your mail credentials (IMAP_USER/IMAP_PASS and SMTP_USER/SMTP_PASS) stored in a plaintext .env file by default — use app passwords and set file permissions (the setup.sh already sets chmod 600). 2) The skill relies on additional env/config values (ALLOWED_READ_DIRS, ALLOWED_WRITE_DIRS, EMAIL_ENV_FILE, EMAIL_CONTACTS_FILE) that are not listed in the registry metadata — review and set these to a minimal whitelist to prevent unexpected file access. 3) The inbox watcher can execute the local OpenClaw CLI to forward alerts (child_process.execFileSync) — if you enable the watcher, it can trigger outbound messages via your OpenClaw agent. 4) Run npm install in an isolated environment and review third-party npm package versions if you need higher assurance. 5) If you want to reduce risk, only enable the watcher when necessary and restrict ALLOWED_* dir lists to trusted directories. If you want me to, I can point to the precise lines where the watcher invokes the OpenClaw CLI and where environment variables are loaded so you can audit them.scripts/email-watch-lite.js:280
Shell command execution detected (child_process).
scripts/email-watch-lite.js:10
Environment variable access combined with network send.
scripts/imap.js:32
Environment variable access combined with network send.
scripts/email-watch-lite.js:109
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97e4kthgphvk3rxsmx374tqeh8468pe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EM Clawdis
Binsnode, npm
EnvIMAP_HOST, IMAP_USER, IMAP_PASS, SMTP_HOST, SMTP_USER, SMTP_PASS