clawmail.xyz - Give your openclaw an email address, no human required!
v1.0.0Email service for AI agents with wallet authentication and crypto payments
⭐ 0· 1.4k·1 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (email service with wallet auth and crypto payments) is coherent with the SKILL.md. However the skill metadata mentions npm/npx/node and an npm package (clawmail) while the registry metadata declared no required binaries. Wallet-based auth and crypto payments imply access to a wallet/private key or an external signing flow, but no credentials or integration details (env vars, providers) are declared. That mismatch (claiming wallet/payment capability but not describing how signing/payment credentials are supplied) is a red flag for ambiguity.
Instruction Scope
The SKILL.md confines runtime actions to invoking the clawmail CLI (npx or installed npm package) and calling the service's REST endpoints. It does not instruct the agent to read arbitrary local files or unrelated system state. However it implicitly requires producing wallet signatures and authorizing x402 payments; the document does not explain whether the agent should use a local wallet, an external signing provider, or prompt the user. That lack of specification gives the agent broad discretion about where/how to obtain a signature, which is potentially sensitive.
Install Mechanism
This is an instruction-only skill but the SKILL.md recommends npx and npm install -g clawmail. Running npx will fetch and execute code from the npm registry at runtime — acceptable for CLI utilities but higher-risk than pure instruction-only skills because it runs remote code. There's no install spec in the registry metadata and the skill did not provide package integrity information (checksums, pinned version). The SKILL.md does include a GitHub repo and homepage which help provenance, but the lack of an explicit, verifiable install spec and integrity checks is a concern.
Credentials
The skill declares no required environment variables or primary credential, yet its core features (wallet authentication, USDC payments) inherently require sensitive secrets (private keys or a delegated signing token) or user interaction. The SKILL.md does provide an auth flow (challenge/sign/login returning a JWT), but it does not state how the signing key is supplied or protected. That gap means the agent or user could be prompted to expose private keys or manually sign messages; the required privilege level is not made explicit.
Persistence & Privilege
The skill does not request always:true and defaults are normal. It suggests adding an entry to a local claude_desktop_config.json to register an MCP server — this modifies a single agent config file but is an expected setup step for a tool integration. There is no evidence the skill asks to persist credentials or alter other skills' configurations.
What to consider before installing
Before installing or running this skill, consider: (1) npx will download and execute the 'clawmail' package from npm at runtime — inspect the npm package and the linked GitHub repo (https://github.com/patrickshuff/clawmail) and prefer a pinned version with checksums. (2) Wallet authentication and USDC payments require signing — decide whether you'll use a dedicated ephemeral wallet with minimal funds or an external hardware wallet; do NOT paste private keys into tools. The SKILL.md does not declare how signing is done, so confirm whether the CLI performs signing locally, delegates to a browser wallet, or requires you to sign messages manually. (3) If you plan to add the suggested MCP entry to claude_desktop_config.json, back up that file first. (4) If you need higher assurance, request the author to provide: an explicit install spec with pinned version and checksum, documentation of the signing flow (how private keys are handled), and a security audit or reproducible build. If any of those are missing or you cannot verify the npm package/source, treat this integration as higher risk and run it in a sandboxed environment or decline.Like a lobster shell, security has layers — review code before you run it.
latestvk97672p3zyzk7m76kjhayar64d80kpd9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📧 Clawdis
OSmacOS · Linux · Windows