Gmail Attachment Downloader
v1.1.0Download Gmail attachments through IMAP when the user wants to pull invoices, statements, or other files from Gmail into a local folder. Use it when the task...
⭐ 0· 37·0 current·0 all-time
by@whauff
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included script: the Python script connects to imap.gmail.com, searches messages, and writes attachments locally. Asking for a Gmail address and an app password is appropriate for the stated purpose. The registry metadata, however, does not declare the environment variables (GMAIL_USER/GMAIL_PASS) or a required runtime (python3), which is an omission.
Instruction Scope
SKILL.md limits scope to reading mail and downloading attachments; it explicitly says it does not modify or delete mailbox contents. The runtime instructions ask for only the Gmail credentials and filters required for search; they instruct running the bundled script with explicit arguments rather than performing arbitrary system scans. No instructions ask the agent to read unrelated files or exfiltrate data to external endpoints.
Install Mechanism
There is no install spec (instruction-only + bundled scripts) so nothing will be downloaded during installation. Risk is limited to running the included Python script. The skill assumes a Python runtime is available but does not declare it.
Credentials
The script legitimately requires Gmail credentials (app password) and supports GMAIL_USER/GMAIL_PASS environment variables. Those credentials are proportional to the task. However, the skill metadata did not declare required env vars or a primary credential, which is a mismatch that reduces transparency and should be corrected.
Persistence & Privilege
The skill is not set to always:true and does not request special platform privileges. It writes attachments to the user-specified local folder (expected behavior) and does not modify other skills or agent settings.
Assessment
This skill is coherent for downloading Gmail attachments via IMAP, but review these points before installing or running: 1) It requires a Gmail account with IMAP enabled and an app password (not your normal login password). 2) The registry metadata omits the environment variables (GMAIL_USER, GMAIL_PASS) and the assumed runtime (python3); treat that as a transparency gap. 3) Inspect the bundled script yourself to confirm there are no hidden network calls or surprises (the visible code connects only to imap.gmail.com and writes files locally). 4) Run the script in a safe environment (local machine or isolated VM) and consider creating a dedicated app password for this use. 5) When providing a save folder, pick a directory you control and review the downloaded files before opening them.Like a lobster shell, security has layers — review code before you run it.
attachmentsvk973htv2wnz65v8w7xhcj0pc9184tp7vautomationvk973htv2wnz65v8w7xhcj0pc9184tp7vgmailvk973htv2wnz65v8w7xhcj0pc9184tp7vimapvk973htv2wnz65v8w7xhcj0pc9184tp7vinvoicevk973htv2wnz65v8w7xhcj0pc9184tp7vlatestvk973htv2wnz65v8w7xhcj0pc9184tp7v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.