ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Sinkron

v1.0.7

Provide AI agents with permanent email identities using Sinkron CLI and Python SDK. Requires SINKRON_TOKEN (self-issued by the Sinkron backend via `sinkron r...

⭐ 0· 388·1 current·1 all-time
byWeb3 Hungry@zororaka00
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Skill claims to provide permanent email identities and inbox management via a CLI/SDK and declares a single required credential (SINKRON_TOKEN). There are no unrelated env vars, binaries, or config paths requested — the declared credential is appropriate for the described functionality.
✓
Instruction Scope
SKILL.md contains concrete instructions that stay on-topic: provenance checks, downloading and inspecting the PyPI package, installing a pinned version, running sinkron register for token issuance, and protecting the token. It does not instruct reading unrelated system files or collecting unrelated credentials. It explicitly warns to clear shell history and store tokens securely.
ℹ
Install Mechanism
This is an instruction-only skill (no install spec in the registry), and it recommends installing the sinkron package from PyPI (pip install sinkron==X.Y.Z). Installing from PyPI is a reasonable mechanism for a Python SDK but carries the usual moderate risk of third‑party packages — the SKILL.md sensibly recommends downloading and inspecting the wheel before installing and using an isolated environment. The alternate suggestion to use `uv tool install` is noted but optional; verify any lesser-known tooling before use.
✓
Credentials
Only SINKRON_TOKEN is required and it is justified by the service's authentication model (self-issued token from sinkron register). The SKILL.md also prescribes secure storage and rotation practices for the token. No other secrets or unrelated credentials are requested.
✓
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide config, and has no install-time persistence declared. The default ability for the agent to invoke the skill autonomously is unchanged (normal).
Assessment
This skill appears coherent with its description, but treat third-party packages cautiously: 1) Verify the homepage, GitHub repo, and PyPI owner match and review the package source for unexpected network callbacks before installing. 2) Follow the SKILL.md checklist: download the wheel (.whl) and inspect its .py files, install only a pinned version, and test inside a container/VM first. 3) Protect SINKRON_TOKEN in a secrets manager (do not check it into code or logs), clear shell history after registration, and rotate the token if exposure is suspected. 4) If you cannot verify the package provenance or do not want to install from PyPI, do not install the skill. If you want higher assurance, ask for the release commit hash and PyPI artifact hash (sha256) so you can verify the exact package contents before installing.

Like a lobster shell, security has layers — review code before you run it.

apivk973vqtbav775e9e6m9s6hps9n8251ebautomationvk973vqtbav775e9e6m9s6hps9n8251ebclivk973vqtbav775e9e6m9s6hps9n8251ebemailvk973vqtbav775e9e6m9s6hps9n8251eblatestvk973vqtbav775e9e6m9s6hps9n8251ebsinkronvk973vqtbav775e9e6m9s6hps9n8251eb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments