read-no-evil-mcp

• Analyzed: May 15, 2026, 3:28 AM
• Findings: 1
• Version: 0.3.1
• Hash: a65eb6328608781ea3045cd8dc64fc3875d182d1af8580513fc6082933119496
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill 'read-no-evil-mcp' is designed to provide secure email access with built-in prompt injection protection. The `SKILL.md` explicitly instructs the AI agent to avoid sensitive actions like displaying configuration details (`setup-config.py show`) without user confirmation, demonstrating a strong awareness of prompt injection risks against the agent itself. The `scripts/setup-server.sh` and `scripts/setup-config.py` handle Docker setup and configuration file management responsibly, including controlled handling of `.env` files for credentials and read-only mounting of config files into Docker containers. There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized persistence, or arbitrary command execution beyond the skill's stated purpose.