email-pro-optimized

高性能邮件工具 - 支持 QQ、Gmail、Outlook。IMAP读、SMTP写、OAuth 2.0、并发处理。速度比 imap-smtp-email 快 4-5 倍。

This skill appears to implement a capable multi-provider email client, but it ships with embedded Outlook OAuth credentials and a script that will push the skill directory to a remote Git repo. Those embedded secrets should be treated as sensitive — do NOT run authorize-outlook.sh or any auto-push/maintain scripts without auditing and removing secrets. Recommended steps before installing or running: 1) Inspect and remove any hard-coded client_id/client_secret/tenant values from scripts and README; treat them as compromised if you used them anywhere. 2) Run authorization manually using your own OAuth client credentials (do not reuse the repo's values), and avoid passing secrets on the command line; use interactive input or secure config files with 600 permissions. 3) Do not run scripts/auto-push.py unless you understand and control the remote repo (it will git add/commit/push and could leak data). 4) If you already ran the included credentials, rotate those app secrets in Azure/Google immediately. 5) Prefer running this code in an isolated environment and examine ~/.openclaw/credentials to ensure only expected tokens are stored. If you want, I can point to exact files/lines to remove or show safer ways to perform OAuth authorization and token storage.

Type: OpenClaw Skill Name: q012315-email-pro-optimized Version: 2.2.1 The bundle contains a hardcoded Azure Client Secret and Tenant ID within 'scripts/authorize-outlook.sh' and the README, which is a significant security vulnerability and poor practice. Additionally, it includes scripts like 'scripts/auto-push.py' and 'scripts/sync-updates.py' that perform automated Git operations (add, commit, push) and filesystem synchronization across directories (~/.openclaw/workspace-telegram-bot1). While these appear to be developer utilities for the 'Email Pro' tool, the combination of hardcoded credentials and automated repository/file manipulation poses a high risk of accidental data exposure or unauthorized system changes.