Mail Agent
v0.1.3Set up AI-powered Gmail monitoring in OpenClaw. Watches inbox via Google Pub/Sub and pushes important emails to Telegram. Use when the user wants to install...
⭐ 0· 121·0 current·0 all-time
bynanaco@nanaco666
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The plugin's stated purpose (Gmail → Pub/Sub → classify → Telegram) matches the code and install requirements. It requires gcloud (used for ADC and creating resources) and asks the user to install gog in SKILL.md, but the runtime code uses google.auth.GoogleAuth / ADC rather than invoking gog itself — so gog is useful for interactive Gmail CLI setup but is not strictly required by the plugin code. There are also small version mismatches across metadata/SKILL.md/install URL (registry version 0.1.3 vs SKILL.md 0.2.0 and install URL v0.2.1) which are not fatal but worth noting.
Instruction Scope
SKILL.md guides the user through gcloud, Pub/Sub, enabling Gmail API, and installing the plugin. Those steps are in-scope. The instructions require creating cloud resources, granting Gmail Pub/Sub publisher role, and supplying credentials (ADC or a credentials JSON). They also instruct storing an LLM API key in plugin config; the plugin will send email snippets (up to 500 chars) to the configured LLM endpoint. The instructions do not attempt to read unrelated system files or exfiltrate data to unexpected endpoints beyond the configurable LLM URL.
Install Mechanism
The declared install steps use Homebrew formulas (steipete/tap/gogcli and google-cloud-sdk) and installing the plugin from a GitHub release tarball — standard, traceable sources. No downloads from ad-hoc servers or URL shorteners are used.
Credentials
The skill does not request environment variables but does ask you to supply Google credentials (via ADC or credentialsPath) and optionally an OpenAI-compatible API key (llmApiKey) stored in plugin config. These credentials are proportional to the functionality, but storing an LLM API key and sending email content to an external model are privacy-sensitive actions you should review.
Persistence & Privilege
The skill is not marked always:true and runs only when installed and configured. It registers its own service within OpenClaw and does not request elevated platform-wide privileges or modify other skills' configs.
Assessment
This plugin appears to do what it says: watch Gmail via Pub/Sub, classify messages with an LLM, and forward important ones to Telegram. Before installing: 1) Confirm you trust the GitHub source (homepage provided). 2) Understand it requires GCP setup (projects, Pub/Sub topic/subscription, IAM grant for gmail-api-push) and Google credentials (ADC or a credentials JSON). 3) The plugin optionally sends email excerpts to an external LLM — do not supply an API key if you are uncomfortable sending potentially sensitive email content to that service. 4) The SKILL.md asks you to install and configure gog for Gmail auth, but the plugin uses Google ADC at runtime — gog is helpful for interactive setup but not strictly used by the code. 5) Note the small version/label inconsistencies in metadata and SKILL.md; verify you are installing the intended release. If you proceed, limit the credential scope where possible and review the plugin's repository (or run in a controlled environment) if you need higher assurance.Like a lobster shell, security has layers — review code before you run it.
latestvk977mp6excpvqr50fs7kyzrwf5838zsz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📬 Clawdis
Binsgog, gcloud
Install
Install gog (brew)
Bins: gog
brew install steipete/tap/gogcliInstall gcloud (brew)
Bins: gcloud
brew install google-cloud-sdk