Writing and reading

moltmail.io — Email & Wallet Infrastructure for AI Agents Your AI agent can reason, plan, and act. But it still can't send an email. moltmail fixes that. One...

This skill appears to do what it claims, but you should: (1) only use a throwaway/new wallet or one you control for this skill if you are uncomfortable importing private keys into a third-party tool; (2) protect the passphrase (ETHERMAIL_PASSPHRASE) and the state folder (./state) since it stores the encrypted key and JWT token; (3) review and trust the remote service (https://srv.ethermail.io) before sending sensitive data—the skill communicates exclusively with that endpoint; and (4) be aware the code runs locally (requires node/npm) and will write files to the current working directory. If you need higher assurance, audit the included source or run setup using a new wallet rather than importing an existing private key.

Type: OpenClaw Skill Name: moltmailermp Version: 1.0.0 The skill provides Web3 email functionality via EtherMail, which involves high-risk capabilities such as handling EVM private keys and performing network requests to 'srv.ethermail.io'. Although the code follows security best practices—encrypting keys locally with AES-256-GCM (scrypt-derived), using 0600 file permissions for sensitive data in 'setup.ts' and 'lib/ethermail.ts', and providing clear security notices in 'SKILL.md'—the inherent risk of managing cryptographic material and session tokens qualifies it as suspicious under the provided criteria for risky but plausibly necessary capabilities.