Near Email Reporter

• Verdict: Pass
• Confidence: High
• Analyzed: May 1, 2026, 5:28 AM
• Findings: 3
• Version: 1.0.0

Overview

This is a mostly coherent NEAR email-reporting helper, but it stores SMTP credentials locally and its advertised email/scheduling features are only partially implemented.

This skill appears benign and purpose-aligned, but treat the SMTP password as sensitive. Use an app password, review the local config file permissions, verify any dependency you install, and test whether email delivery and scheduling actually work before relying on the skill for alerts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Anyone who can read the config file or recover the command invocation may be able to use the SMTP account to send email.

Why it was flagged

The script accepts an SMTP password as a command-line option and persists it in a local config file. This is expected for SMTP reporting, but it gives the skill access to email-sending credentials.

Skill content

else if (args[i] === '--pass') options.pass = args[++i]; ... await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });

Recommendation

Use an app-specific SMTP password, avoid reusing your main email password, protect or delete ~/.near-email/config.json when no longer needed, and consider safer secret-entry methods if modifying the script.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

Installing an external package adds supply-chain trust in that package and the npm source used at install time.

Why it was flagged

Real email sending depends on a user-installed external npm package, but the artifact does not pin a version or declare it as a package dependency. This is a normal integration step, but users should verify what they install.

Skill content

For actual email sending, install nodemailer:
```bash
npm install nodemailer
```

Recommendation

Install dependencies from trusted sources, consider pinning a known-good nodemailer version, and review package changes before using it with SMTP credentials.

ASI09: Human-Agent Trust Exploitation

NoteHigh Confidence

What this means

A user could believe alerts or scheduled reports are active when the included script only prints what it would do.

Why it was flagged

The script indicates alert and scheduling behavior is not actually implemented, while the skill description advertises alerts, scheduling, and automatic reporting.

Skill content

console.log('Alert functionality requires nodemailer for email sending.'); ... console.log(`Would set up alert for ${args[0]} at ${args[1]} NEAR threshold`); ... console.log('Schedule functionality requires cron or job scheduler.');

Recommendation

Test the reporting flow before relying on it, and do not treat alerts or scheduled reports as active unless you add and verify real email-sending and scheduler integration.