Qq Email Watcher

• Outcome: Review
• Latest audit: May 28, 2026 · 11:05 AM UTC
• Version: 1.0.1

Overview

This skill implements a QQ email notifier, but it ships with real-looking mailbox credentials and a fixed QQ recipient that could expose private email if run without careful reconfiguration.

Review carefully before installing. Replace EMAIL, AUTH_CODE, and QQ_TARGET with your own values before any run, avoid storing the IMAP authorization code in source control, rotate any exposed auth code, and assume whitelisted email subjects/body previews may be processed by OpenClaw AI and sent over QQ.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

4. 50字以内
"""
    try:
        result = subprocess.run(
            [
                "openclaw", "agent",
                "--session-id", "email-summarizer",

• Confidence: 92% confidence
• Finding: result = subprocess.run( [ "openclaw", "agent", "--session-id", "email-summarizer", "-m", prompt, "--thinking", "off

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes and instructs users to run a long-lived script that reads local files, writes logs/state, uses network access to connect to email/AI/QQ services, and invokes shell commands, yet no permissions are declared. This weakens user consent and platform enforcement because the real capability footprint is broader than what the manifest communicates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior materially understates sensitive actions: mailbox credentials are configured in-script, email contents are sent out for AI summarization, and notifications go to a QQ target, while the description frames this as a simple whitelist-based monitoring utility. That mismatch can cause users to expose credentials and private email content without fully informed consent, increasing the risk of data leakage and misuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill invokes an external AI agent subprocess for summarization and explicitly inherits the current environment while also setting a session ID. That gives a mailbox-processing path access to a broader capability surface than needed, potentially exposing tokens, session context, or tool-enabled behavior if malicious email content manipulates the agent. The skill context increases danger because email is externally sourced and routinely attacker-controlled.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The invocation text is broad enough to match generic email-related requests, which may cause the skill to activate in contexts where the user did not intend continuous monitoring or third-party transmission of mail content. Over-broad triggering is especially risky here because the skill handles sensitive communications and persistent background behavior.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The description omits a clear warning that the skill continuously monitors the mailbox and may transmit email content externally for notification delivery and AI summarization. In a mailbox-monitoring context, this omission is dangerous because users may unknowingly expose sensitive personal, financial, or authentication data from incoming emails.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly instructs users to hardcode a QQ email address, IMAP authorization code, and QQ target identifier directly into a Python script. Storing live credentials in source files increases the chance of accidental exposure through backups, screenshots, file sharing, version control, or local compromise, and in this skill context those secrets could enable mailbox access and message delivery actions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code transmits email contents to an external AI component without any visible consent, disclosure, or per-message opt-in. Emails may contain verification codes, financial details, links, and sensitive personal data, so this creates a meaningful confidentiality and compliance risk. In a mail-watcher skill, users may reasonably expect monitoring and notification, but not secondary disclosure to an AI processor.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill forwards subject/sender/body-derived previews from whitelisted emails to QQ without any visible disclosure in the code path about outbound sharing. This is likely core functionality rather than malicious behavior, but it is still a privacy vulnerability because sensitive mail contents are pushed into another channel and service. Whitelisting lowers volume but not sensitivity, since trusted senders often send the most sensitive messages.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.