IMAP Email Reader

Read and manage email via IMAP (ProtonMail Bridge, Gmail, etc.). Check for new/unread messages, fetch content, search mailboxes, and mark as read/unread. Works with any IMAP server including ProtonMail Bridge.

Install only if you are comfortable giving the agent access to your mailbox. Use a Bridge-generated or app-specific password, manually ensure .env is excluded from version control and permissions are restricted, keep certificate checks enabled except for trusted local Bridge use, and replace or avoid the cron iMessage example unless you explicitly want email summaries sent to that destination.

Type: OpenClaw Skill Name: imap-email Version: 1.0.3 The skill is classified as suspicious due to the presence of a configurable option, `IMAP_REJECT_UNAUTHORIZED=false`, which, while documented for specific use cases like ProtonMail Bridge, introduces a significant man-in-the-middle (MITM) vulnerability if enabled without proper understanding or in untrusted environments. Additionally, the `setup.sh` script directly writes user-provided credentials into the `.env` file. While the Node.js script loads these as environment variables, this pattern of direct user input handling in a shell script can be a vulnerability if not carefully implemented or if the input is maliciously crafted, even if not immediately exploitable for shell injection in this specific context. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, backdoors, or stealthy operations.