QQ Mail

Manage QQ Mail via IMAP/SMTP to read, send (with attachments), search emails by subject/sender/date, and list folders using Python.

This skill appears internally consistent for managing QQ Mail via IMAP/SMTP. Before installing: 1) Verify you trust the skill source/owner sinceHomepage/source is missing — review the included scripts yourself. 2) Only set QQMAIL_AUTH_CODE (the IMAP/SMTP authorization code), not your QQ account password; follow QQ's instructions for generating the授权码. 3) Be cautious when using the send-with-attachment command — it reads local file paths you provide. 4) Prefer running the script in a controlled environment (isolated account or container) and avoid placing the auth code in shared/global environment variables. 5) If you plan to allow autonomous agent invocation, remember that the agent could use your auth code to read/send mail when triggered — enable autonomy only if you trust the skill and its maintainer.

Type: OpenClaw Skill Name: qqmail Version: 1.0.0 The skill is classified as suspicious due to two primary reasons. First, the `send` command in `scripts/qqmail.py` allows attaching arbitrary files from the local filesystem via the `--attachment PATH` argument. While a legitimate feature, this capability could be exploited by a malicious agent prompt to exfiltrate sensitive user files (e.g., credentials, private keys). Second, the `search` command in `scripts/qqmail.py` constructs IMAP search queries by directly concatenating user-provided arguments (e.g., `--subject`, `--from`) into the search string, which presents a potential IMAP injection vulnerability if a malicious user provides specially crafted input. There is no evidence of intentional malicious behavior such as hardcoded exfiltration domains, backdoors, or obfuscation; the issues are vulnerabilities or risky capabilities rather than explicit malware.