claw-mail

This skill seems to implement a full-featured email client and is internally consistent with its description, but it can access credentials (env://, keychain://, op://) and can POST processed message data to arbitrary webhook URLs via rule actions. Before installing: - Review any config.yaml you will use: do not store secrets inline in the skill root. Prefer 1Password or a secure vault over env:// for very sensitive variables. - Inspect rules that include webhook_url and ensure endpoints are trusted; webhook actions will send message metadata (and potentially message content) to external services. - Audit scripts/lib/credential_store.py and references to env:///op:///keychain:// in the repository to confirm exactly how credentials are read and resolved. - If you must test, run the skill in an isolated environment or sandbox and avoid pointing it at production accounts or sensitive environment variables until you are comfortable with its behavior. - If you need stricter guarantees: require that configs do not contain env:// references for secrets, disable webhook rules, or restrict webhook endpoints to known internal services. I judged this 'suspicious' (not 'malicious') because the code and SKILL.md align with an email-management purpose, but the combination of credential resolution and webhook rule actions creates a plausible avenue for data exfiltration if misconfigured or if the config originates from an untrusted source. Additional review of the omitted files (credential_store, processor, webhook implementation) would increase confidence.