ClawHub
Back to skill

Security audit

Openclaw Email Bypass

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims, but it should be reviewed because it lets an agent send email through a public Google Apps Script relay as the user with only a shared token protecting it.

Review before installing. Use only with a Google account you are comfortable sending automated email from, inspect or supply the missing Google Apps Script relay code, require an HTTPS Apps Script URL, store a long random token as a secret, rotate it if exposed, and add recipient/rate controls or per-send approval before allowing an agent to send messages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes network access and reads sensitive configuration from environment variables, but it does not declare permissions to reflect those capabilities. This creates a transparency and policy-enforcement gap: users or hosting systems may approve the skill without realizing it can exfiltrate data over HTTPS or use secrets such as GOOGLE_SCRIPT_TOKEN. The skill context makes this somewhat more sensitive because its stated purpose is to bypass SMTP restrictions, which is a legitimate use case but also closely aligned with data egress and abuse scenarios.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README promotes sending email through a Google Apps Script relay and emphasizes security, but it does not clearly disclose that email bodies, subjects, recipient addresses, and related metadata are processed by Google services via MailApp. This can mislead users into assuming the solution is more private than it is, causing unintended exposure of sensitive content or regulated data to a third-party platform.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The metadata explicitly advertises routing email through a private Google Apps Script relay to bypass blocked SMTP ports, but it does not warn users that message contents, recipients, and related metadata may transit through and be exposed to a third-party script environment. This creates a real privacy and security risk because users may unknowingly send sensitive email through infrastructure they do not control or audit.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The setup explicitly instructs users to deploy the Google Apps Script as a web app accessible to "Anyone" while relying only on a shared bearer token for protection, but it does not clearly warn that this exposes a publicly reachable email-sending endpoint. If the token is leaked, guessed, logged, or mishandled, an attacker could abuse the relay to send unauthorized email, enabling spam, phishing, account reputation damage, or quota exhaustion.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.