iGPT email ask

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill is coherently designed for email analysis through iGPT, but it requires an iGPT API key and access to connected email data, so users should only install it if they trust that service with their email context.

Before installing, make sure you trust iGPT with the connected email account, use the least-privileged or intended API key, and verify important summaries or action items against the original emails. Use an isolated Python environment for the `igptai` package if you follow the setup instructions.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can use the user's iGPT credentials to analyze email data that has been connected to iGPT.

Why it was flagged

The skill requires an API key and an OAuth-connected email datasource, which is sensitive delegated account access, but this is directly aligned with the email-analysis purpose.

Skill content
An iGPT API key ... A connected email datasource -- the user must have completed OAuth authorization via `connectors/authorize` before ask will return results.
Recommendation

Confirm the API key belongs to the intended account, review what email datasource is connected, and revoke the key or OAuth connection when no longer needed.

What this means

Summaries, action items, sentiment, or risk analysis could be influenced by the content of emails being analyzed.

Why it was flagged

The skill grounds answers in retrieved email context; email content can include misleading, stale, or adversarial text that may affect summaries or recommendations.

Skill content
queries iGPT's `recall/ask` endpoint to generate answers grounded in a user's connected email data
Recommendation

Treat generated conclusions as assistance, not authority; verify important decisions, deadlines, and owners against the original emails.

What this means

Email-derived context and prompts may be processed by iGPT's external API rather than staying entirely local.

Why it was flagged

The skill sends user questions and uses connected email context through an external provider API; this data boundary is expected for the purpose but privacy-sensitive.

Skill content
Secure, per-user-isolated email reasoning and analysis via the iGPT Context Engine API
Recommendation

Review iGPT's privacy, retention, and access controls before using the skill with confidential or regulated email content.

What this means

Installing the package adds third-party code to the user's Python environment.

Why it was flagged

The setup instructions require installing an external Python package, and the provided instruction does not pin a package version; this is common and purpose-aligned for an API client, but users should be aware of dependency provenance.

Skill content
pip install igptai
Recommendation

Install from a trusted package index, consider pinning a known-good version, and use an isolated virtual environment.