Zoho Mail

Full read/write Zoho Mail access for OpenClaw agents

This skill appears coherent with its stated purpose, but before installing: 1) remember it has full read/write access to the linked Zoho mailbox — treat the required client credentials and ZOHO_MAIL_TOKEN_KEY as highly sensitive; 2) verify the GitHub release you download (check tags and the provided checksums) to avoid installing a tampered binary; 3) store the three secrets in a secure secrets manager and ensure the instance's .env/SSM parameters are protected from other users/processes; 4) the operator must perform an interactive OAuth login (pasting the full redirect URL) — ensure that process is done securely; 5) if you need principle-of-least-privilege, consider creating a Zoho client with minimal scopes or a dedicated mailbox account rather than using a high-privilege personal account.

Type: OpenClaw Skill Name: panthrocorp-zoho-mail Version: 0.3.1 The Zoho Mail skill provides full read/write access to Zoho Mail accounts as advertised. The implementation follows security best practices, including AES-256-GCM encryption for OAuth tokens at rest (internal/crypto/encrypt.go) and a persisting token source that safely updates credentials (cmd/mail.go). The code is well-structured, lacks any signs of obfuscation or unauthorized data exfiltration, and the installation process in SKILL.md correctly points to the project's official GitHub releases.