ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

CDP Gmail Delivery

v1.0.6

Send files reliably from an operator-controlled Chrome debug session using Gmail CDP automation with Google Drive share-link fallback. Use when direct channe...

⭐ 0· 26·0 current·0 all-time
by@joustonhuang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (Gmail CDP delivery with Drive fallback) match the included files and runtime needs: Node/npm, puppeteer-core, and connecting to a local Chrome CDP endpoint. Requiring a visible Chrome debug session and a manual operator sign-in is coherent for this purpose.
ℹ
Instruction Scope
Instructions stay within the stated task: restart a debug Chrome, have a human sign in, connect to 127.0.0.1:9222, compose, attach, send, and verify. Minor notes: the workflow assumes an external script scripts/restart_debug_chrome.sh exists in the workspace (not bundled here) and instructs the agent to run it; the send script also honors an optional env var CDP_GMAIL_DELIVERY_PUPPETEER (not declared in SKILL.md's env list). References/receipts include example absolute file paths and system paths (privacy metadata), but the current send script's console output avoids printing absolute paths.
✓
Install Mechanism
Installer is a local bash script that creates a skill-scoped .runtime and runs npm install puppeteer-core@24. This is a standard npm install (traceable) and the runtime is kept local to the skill. No arbitrary URL downloads or executable extraction from unknown hosts.
ℹ
Credentials
The skill declares no required env vars which matches typical usage. Implementation optionally reads CDP_GMAIL_DELIVERY_PUPPETEER to locate puppeteer-core; that env var is not documented in SKILL.md (minor documentation mismatch). No unrelated cloud credentials are requested.
✓
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and limits persistence to a local .runtime directory. It requires a live user-controlled browser session but does not attempt to install persistent system-wide services.
Assessment
This skill appears to do what it says: automate a visible Chrome debug session to send mail and fall back to Drive links. Before installing, check: (1) review the workspace script scripts/restart_debug_chrome.sh (the skill expects you to run it) to ensure it doesn't perform unexpected system actions; (2) understand the skill will act as whichever Gmail account is signed into the debug Chrome session (so do not run it in a browser logged into unintended accounts); (3) the install runs npm install puppeteer-core@24 — verify you are comfortable installing that package; (4) references include example absolute paths and local usernames (privacy metadata) — confirm logging/receipts won't leak sensitive local paths in your environment; (5) the code accepts an optional env var CDP_GMAIL_DELIVERY_PUPPETEER (not documented) if you want to point it at a custom puppeteer; consider setting/omitting it as desired. If these points are acceptable, the skill is internally coherent.

Like a lobster shell, security has layers — review code before you run it.

latestvk97423nva4sw1aqb260rrhkkk184snqv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsnode, npm

Comments