IMAP Email Reader

Read and manage email via IMAP (ProtonMail Bridge, Gmail, etc.). Check for new/unread messages, fetch content, search mailboxes, and mark as read/unread. Works with any IMAP server including ProtonMail Bridge.

Install only if you are comfortable giving an agent access to your mailbox. Use a dedicated app or Bridge-generated password, manually ensure .env is gitignored and chmod 600, keep certificate validation enabled except for trusted local ProtonMail Bridge use, avoid less-secure Gmail access, and replace or remove the cron iMessage example unless you explicitly want email summaries sent to that destination.

Type: OpenClaw Skill Name: imap-email Version: 1.0.3 The skill is classified as suspicious due to the presence of a configurable option, `IMAP_REJECT_UNAUTHORIZED=false`, which, while documented for specific use cases like ProtonMail Bridge, introduces a significant man-in-the-middle (MITM) vulnerability if enabled without proper understanding or in untrusted environments. Additionally, the `setup.sh` script directly writes user-provided credentials into the `.env` file. While the Node.js script loads these as environment variables, this pattern of direct user input handling in a shell script can be a vulnerability if not carefully implemented or if the input is maliciously crafted, even if not immediately exploitable for shell injection in this specific context. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, backdoors, or stealthy operations.