.Imap Smtp Email.Disabled.20260401 113327
v1.0.0Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Sup...
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill name/description match its implementation: it provides IMAP receive and SMTP send functionality and requires node/npm (declared). It manages account credentials via a local ~/.config/imap-smtp-email/.env file created by setup.sh rather than listing specific environment variables in registry metadata; this is pragmatic but the metadata omission is worth calling out.
Instruction Scope
The SKILL.md and scripts limit actions to: reading the local config file, connecting to IMAP/SMTP servers, reading/writing attachments only under ALLOWED_READ_DIRS / ALLOWED_WRITE_DIRS, and sending test emails during setup. There are no hidden network callbacks or out-of-band exfil endpoints in the code—only standard IMAP/SMTP connections.
Install Mechanism
There is no automated install that downloads arbitrary code; the package includes local Node scripts and a shell setup helper. No remote archives or URL-based installers are used. The user must run setup.sh and has to have node/npm installed.
Credentials
The skill does not declare required env vars in registry metadata, but it legitimately needs IMAP/SMTP credentials (IMAP_USER/IMAP_PASS, SMTP_USER/SMTP_PASS, hosts/ports) stored in ~/.config/imap-smtp-email/.env. Those credentials are saved in plaintext to disk by setup.sh. The code enforces ALLOWED_READ_DIRS and ALLOWED_WRITE_DIRS which limits filesystem access; however storing passwords unencrypted on disk is a sensitive practice the user should consider.
Persistence & Privilege
The skill writes/reads its own config file under ~/.config/imap-smtp-email/.env and does not request platform-wide persistent privileges (always:false). It does not modify other skills or global agent settings. Note: as with all skills, autonomous invocation is permitted by default, but this skill's network actions are limited to IMAP/SMTP servers.
Assessment
This skill is coherent with its description and implements an on-disk config-driven email client. Before installing: (1) review the setup.sh and scripts yourself if you can, because setup.sh will prompt for and write your email credentials to ~/.config/imap-smtp-email/.env (stored plaintext); (2) prefer provider-specific App Passwords/authorization codes (e.g., Gmail app password) instead of your primary account password; (3) set ALLOWED_READ_DIRS and ALLOWED_WRITE_DIRS tightly (single directory) to limit file access; (4) understand setup.sh will attempt IMAP and SMTP tests (it may send a test email to your address); (5) if you need stronger protection, keep the config file on encrypted storage or modify the code to read credentials from a secure secret store rather than an unencrypted .env.Like a lobster shell, security has layers — review code before you run it.
latestvk97de0dnnpgp2m51nnf11p2gpn8417c1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📧 Clawdis
Binsnode, npm