Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:40
- Evidence
const result = spawnSync(process.execPath, args, { stdio: "inherit" });
Security audit
@psyb0t/mailbox
Security checks for vulnerabilities and agentic risk
Overview
This package is a clearly disclosed bridge from OpenClaw to a user-run mailbox server, with sensitive email actions that match its stated purpose.
Install only if you intend your agent to access the configured mailbox server, including the ability to send and delete mail. Use a scoped mailboxd token where possible, point MAILBOX_URL only at a server you control, and remember that the bridge passes the bearer token to the local proxy process as a command-line header argument.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec