Email Monitor

Set up periodic email monitoring for any IMAP mailbox (Gmail, Outlook, QQ, etc.). Guides users through mailbox configuration, tests the connection, then crea...

This skill appears to do what it says, but consider these points before installing: - It asks you to provide and stores mailbox credentials (app password or account password) in plaintext at ~/.openclaw/email-monitor/<sanitized-email>/config.json. Prefer app passwords + 2FA (Gmail) and restrict the file: chmod 600 <config>. Delete the config to revoke access. - Fetched email bodies and attachments may be printed to stdout and shown in chat — avoid feeding highly sensitive mail if you don't want it displayed or stored in chat history. - Attachment downloads (if enabled) are written to the user-specified directory; ensure that path is safe and not world-readable if attachments are sensitive. - The skill creates a cron job via `openclaw cron add` to run the included Python script; the job runs as your user and will have access to the config/state files. Verify the cron command and <skill_dir> expansion when confirming. - Because the skill stores credentials locally, remove the config/state files and cron entry to fully revoke the skill's access. - If you need stronger protection, consider creating a dedicated mailbox or app password with limited rights for monitoring rather than using your primary account password. Overall: internally consistent with the stated purpose, but handle stored credentials and output visibility carefully.

Type: OpenClaw Skill Name: qiusuo-email-monitor Version: 1.0.0 The skill manages sensitive email credentials (including app passwords) and stores them in plaintext in the user's home directory. Additionally, the attachment downloading logic in `scripts/fetch_emails.py` is vulnerable to path traversal, as it uses unsanitized filenames from email headers in `os.path.join`, potentially allowing an attacker to overwrite arbitrary files on the system. While these are high-risk security flaws, they appear to be unintentional vulnerabilities rather than evidence of malicious intent.