Proton Bridge Email

Send email through Proton Mail Bridge (localhost SMTP) using age-encrypted credentials. Use when setting up Proton Bridge for an agent mailbox, encrypting Bridge credentials (no 1Password), or sending automated emails (daily reports, alerts) via Proton Bridge.

This skill appears to implement what it claims (encrypt an env file with age and send mail through local Proton Bridge), but the package metadata omits key runtime requirements. Before installing or running: (1) verify you have the 'age' binary and Python3 available; (2) confirm you are comfortable the script will read your age private key at ~/.config/age/keys.txt and the encrypted file at ~/clawd/secrets/proton.env.age (these paths are hard-coded); (3) inspect send_email.py (it calls the 'age' binary via subprocess and creates an unverified SSL context for localhost), and consider running it in an isolated environment or container if you are unsure; (4) do not store secrets on shared machines and keep file permissions restrictive; and (5) ask the publisher to update metadata to declare required binaries and config paths so the skill's expected privileges are explicit.

Type: OpenClaw Skill Name: protom-bridge-email Version: 1.0.0 This skill is classified as suspicious due to its handling of sensitive credentials and execution of external commands. The `scripts/send_email.py` script decrypts `PROTON_BRIDGE_PASS` and other sensitive environment variables from `~/clawd/secrets/proton.env.age` using an `age` identity key from `~/.config/age/keys.txt` via `subprocess.check_output(['age', '-d', ...])`. While this is central to the skill's stated purpose of sending emails via Proton Mail Bridge, the direct decryption and use of sensitive credentials, combined with external command execution, represents a high-risk capability. There is no clear evidence of intentional malicious behavior like exfiltration to unauthorized endpoints, but the inherent risk of handling secrets in this manner warrants a 'suspicious' classification.