Email Summary

邮件摘要技能 - 自动获取并摘要每日邮件（QQ 邮箱）

Do not install or run this skill as-is. Before proceeding: 1) Remove the committed config/email-config.json and data/emails.json from the package — they contain a real-looking email address and an IMAP auth code and a large mailbox dump. Treat those as leaked secrets; if they are yours, immediately rotate the authorization code. 2) Replace the config file with a template (config.example.json) and enter your credentials locally only when prompted by setup. 3) Inspect the default WEIXIN_CHANNEL/ACCOUNT/USER_ID values — replace them with your own or unset them so messages are not pushed to a third party. 4) Review use of execSync/openclaw CLI: ensure the openclaw messaging endpoint/account is trusted, and run the scripts in an isolated environment first. 5) If you cannot verify why the repo included real credentials/emails, consider the package untrusted and avoid running it; request a clean release (no credentials/data) from the author or use an alternative implementation.

Type: OpenClaw Skill Name: qq-email-summary Version: 1.0.0 The skill bundle exhibits high-risk behavior and significant data leakage, likely due to extreme developer negligence or a 'phone home' data collection strategy. Most critically, 'scripts/summarize-emails.js' contains a hardcoded default WeChat USER_ID ('[email protected]') which causes user email summaries to be exfiltrated to the author if environment variables are not configured. Furthermore, the bundle improperly includes a live 'config/email-config.json' file containing a plaintext QQ email address and IMAP authorization code, alongside 'data/emails.json' which contains over 1,600 private email headers. While the inclusion of the author's own credentials suggests a lack of hygiene rather than targeted malice, the hardcoded reporting sink remains a significant security risk.