Send outbound emails via the Mailgun API. Uses MAILGUN_API_KEY, MAILGUN_DOMAIN, MAILGUN_REGION, and MAILGUN_FROM.

This skill appears to do exactly what it says: it needs your Mailgun API key and domain to send email. Before installing, consider: (1) only provide a Mailgun API key you trust the skill to use—prefer a scoped/limited key if Mailgun supports it; (2) be aware the skill can send emails to arbitrary recipients while it has the key, so don't expose highly-privileged keys in shared environments; (3) npm dependencies carry normal supply-chain risk—review versions if you need stricter controls; (4) if you plan to allow autonomous invocation, limit where it can send or require explicit confirmation to avoid accidental mass sends. Rotate the API key if you later remove the skill or suspect it was exposed.

Type: OpenClaw Skill Name: mailgun-simple Version: 2.2.0 The OpenClaw skill 'mailgun-simple' is benign. It correctly implements an email sending utility using the official Mailgun JS SDK, reading necessary API credentials and domain information from environment variables as expected. The `SKILL.md` provides clear, non-malicious instructions and specifies legitimate dependencies. The `scripts/send_email.js` file directly passes user inputs to the Mailgun SDK without any signs of command injection vulnerabilities, data exfiltration, or other malicious activities. All observed behavior aligns with the stated purpose of sending outbound emails.