Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
military bidding email
v0.2.8军工采购（军采）商机专用推报工具。汇总三大军采平台数据，生成 Excel 并通过 SMTP 发送邮件报告。与政府采购（政采）工具无关，仅处理军队采购渠道。当用户说"milb-email"、"军工商机邮件"、"推送军工商机"、"军工商机通报"时触发。注意：这不是通用邮件客户端，仅用于执行 milb 业务逻辑。
⭐ 0· 186·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code implements the claimed functionality (fetch data, build Excel, send via SMTP). However the registry metadata lists no required environment variables while SKILL.md and the code require multiple EMAIL_* settings (SMTP host/port/user/password, from/to, templates). The skill also depends on an external package/binary 'milb_fetcher' (imported as milb_fetcher.fetcher) which is not provided in the bundle; requiring that external binary is reasonable for fetching, but the omission from top-level environment/requirements declarations is an inconsistency.
Instruction Scope
Runtime instructions and code read configuration from .env files and use paths outside the package: code searches for .env in current working directory or ~/.config/milb-email/.env, SKILL.md instructs creating milb_email/.env, and CLAUDE.md refers to an attachment path under ~/.openclaw/workspace/military-bidding/. These mismatched config paths and the use of a workspace path outside the package are inconsistent and expand the skill's scope beyond the advertised 'package-local' configuration.
Install Mechanism
No official install spec is present in registry metadata, but SKILL.md contains a metadata line recommending 'pip install -e {baseDir}' and a pyproject.toml is included so editable pip install is possible. This is a reasonable install method (local package), but the registry's lack of an explicit install instruction is an omission to be aware of.
Credentials
The tool legitimately needs SMTP credentials and email addresses to send reports; these are present in SKILL.md and get_email_config(). However the top-level skill requirements list zero environment variables, which is misleading. The skill will require EMAIL_SMTP_PASSWORD (sensitive) and other EMAIL_* secrets — users must recognize they are giving an SMTP credential capable of sending email. The code also reads config from home directories and may access attachment files in ~/.openclaw/workspace, which grants the skill access to files outside its own directory.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide persistent privileges. It uses a /tmp lock file to prevent concurrent runs and reads/writes user-space files (workspace path), but it does not modify other skills or agent configuration.
Scan Findings in Context
[no_pre_scan_findings] expected: The static regex pre-scan reported no findings. That is not surprising (no obvious obfuscated or network-exfil strings), but absence of matches does not mitigate the configuration and metadata mismatches found in the code and SKILL.md.
What to consider before installing
Key points to consider before installing or running this skill:
- The skill requires SMTP credentials (EMAIL_SMTP_USER and EMAIL_SMTP_PASSWORD) and email addresses to operate. These are sensitive: anyone with these credentials can send email via that SMTP server. Only supply them if you trust the code and the environment.
- Metadata inconsistencies: registry metadata lists no required env vars, yet the SKILL.md and code require several EMAIL_* values. Confirm the actual required environment variables and where the .env must live before use.
- Configuration path mismatch: SKILL.md suggests milb_email/.env, but the code looks in the current working directory or ~/.config/milb-email/.env. CLAUDE.md mentions an attachment path under ~/.openclaw/workspace. Clarify which paths will be read/written to avoid accidental exposure of other files.
- External dependency: the fetch logic depends on a separate package/binary 'milb_fetcher' (not included). Verify the provenance and content of milb_fetcher before installing; it is responsible for retrieving data from the three military procurement sites and could perform additional network operations.
- Review attachments: the code will attach an Excel file from ~/.openclaw/workspace/military-bidding/… ensure that directory only contains files you expect to be sent.
- To raise confidence: request or inspect the milb_fetcher source, update registry metadata to declare required env vars explicitly, and fix SKILL.md/docs so the expected .env path and install instructions match the code. If you cannot verify those, treat the skill as potentially risky to run with real SMTP credentials or in environments containing sensitive files.Like a lobster shell, security has layers — review code before you run it.
latestvk978xyem2wtdsx46mmpnf9p41s848697
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📧 Clawdis
Binsmilb-email, milb-fetcher