Security audit
Security checks across malware telemetry and agentic risk
This is a legitimate email-monitoring skill, but it handles mailbox credentials and sends email previews to a webhook the user configures.
Install only if you trust the configured webhook and are comfortable letting the skill monitor the selected mailboxes. Prefer keyring or a secrets manager, run chmod 600 on any config file containing passwords or tokens, avoid remote non-HTTPS webhooks, and remember that email previews may be passed into OpenClaw automation.
# 2. Store passwords in keyring python3 -c " import keyring, getpass, json from pathlib import Path config_path = Path.home() / '.openclaw' / 'imap-idle.json'
for account in config['accounts']:
username = account['username']
password = account['password']
keyring.set_password('imap-idle', username, password)
print(f'✅ Stored password for {username}')
"for account in config['accounts']:
username = account['username']
password = keyring.get_password('imap-idle', username)
if password:
account['password'] = password
print(f'✅ Restored password for {username}')self.logger.debug(f"🔐 Using keyring password for {username}")
return password
except Exception as e:
self.logger.warning(f"⚠️ Keyring access failed for {username}: {e}")
# Fall back to config file
password = account_config.get('password')self.logger.debug(f"🔐 Using keyring password for {username}")
return password
except Exception as e:
self.logger.warning(f"⚠️ Keyring access failed for {username}: {e}")
# Fall back to config file
password = account_config.get('password')print(f"✅ Password stored in system keyring for {username}")
# Don't include password in config
except Exception as e:
print(f"⚠️ Failed to store in keyring: {e}")
print("Falling back to config file storage")
account['password'] = password
else:62/62 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal