腾讯企业邮箱/qqexmail

通过 IMAP/SMTP 收发腾讯企业邮箱（exmail.qq.com）邮件。支持发送邮件、收取邮件列表、获取邮件正文。凭证从环境变量读取。

This skill appears to implement the advertised Tencent Exmail IMAP/SMTP features, but there are important caveats: (1) the registry metadata incorrectly claims no required env vars or binaries — the scripts need Node.js and two environment variables (EXMAIL_ACCOUNT and EXMAIL_AUTH_CODE); (2) SKILL.md mentions a --days option but receive.js does not implement it; get-body.js may not reliably fetch by UID due to how the IMAP fetch is called and uses a short timeout — these are functional bugs, not obvious malicious behavior; (3) send.js disables strict TLS verification (tls.rejectUnauthorized: false), which reduces TLS checks (may be needed in some setups but weakens security); (4) EXMAIL_AUTH_CODE grants full mailbox access — do not store it in code or public repos and rotate it if exposed. Before installing: review the code yourself (or have a developer review) and only provide credentials in a controlled environment; prefer running the scripts locally rather than giving these env vars to an autonomous agent you don't fully control. If you plan to trust this skill broadly, ask the author to correct metadata, implement the --days option (or update docs), and address the get-body UID correctness and timeout handling.

Type: OpenClaw Skill Name: qqexmail Version: 1.0.0 The skill provides legitimate functionality for managing Tencent Enterprise Email via IMAP and SMTP, but it contains a significant security vulnerability. Specifically, `scripts/send.js` explicitly disables TLS certificate validation (`rejectUnauthorized: false`), which exposes the SMTP connection to Man-in-the-Middle (MITM) attacks. While the code logic aligns with the stated purpose and shows no evidence of intentional malice or data exfiltration, the prompt instructions require classifying such vulnerabilities as suspicious.