quiet-mail

Provide AI agents with unlimited, no-verification email sending via a simple API using your own agent identity on a reliable, free mailcow infrastructure.

This skill contains a full FastAPI email service implementation but the registry metadata falsely claims there are no required environment variables. Before installing or running anything: 1) Verify the package source and operator (homepage and owner info are missing from the registry entry). 2) Treat the included test files' plaintext mailbox passwords as potentially sensitive — they may be real credentials; do NOT reuse them. 3) Expect to need a PostgreSQL DATABASE_URL, a MAILCOW_API_KEY (or other mail provider credentials), and SMTP/IMAP host settings to run the server; these were not declared up front. 4) If you only want the client-side API calls described in SKILL.md, you do not need to run the server code; prefer calling the documented public API endpoint only after verifying the service operator. 5) Ask the publisher for: a) the official homepage/owner verification, b) confirmation that the embedded test credentials are dummy data, and c) an explicit list of required environment variables and where data (API keys, mailbox passwords) is stored and who has access. Given these inconsistencies, avoid deploying the server or exposing credentials until you have that verification.

Type: OpenClaw Skill Name: quietmail Version: 1.0.0 The skill bundle is classified as suspicious due to the presence of hardcoded credentials in test files. Specifically, `test_send_email_direct.py` and `test_testbot_smtp.py` contain hardcoded email addresses and their corresponding plaintext passwords for test accounts (`[email protected]`, `[email protected]`). Additionally, `tests/phase2_test.py` contains hardcoded PostgreSQL database credentials (`quietmail:quietmail`) and logic to retrieve API keys directly from the database. While these are test files and not part of the core skill execution for an AI agent, their inclusion in the bundle represents a significant security vulnerability if the service were deployed using these files, potentially exposing sensitive internal credentials. The `SKILL.md` and `API.md` files do not contain any evidence of prompt injection or malicious instructions to the AI agent.