Se Gmail Monitor

Monitor and manage Gmail accounts for Your Agency Name. Use when checking emails, sending emails, scanning for urgent messages, or performing email triage. S...

This skill will access a local JSON config containing email addresses and app_passwords and can send emails. Before installing: 1) Do not assume no credentials are needed — verify where your .gmail-config.json must live and what it contains. 2) Fix the hard-coded path in the script (it uses /Users/your-agent/..., while SKILL.md points to ~/.openclaw/...), or place the config at the exact expected location. 3) Confirm the config keys (account names like 'boris' vs 'agent' vs 'info') match what the script expects. 4) Ensure the agent always asks for explicit user confirmation before sending (the script currently sends immediately when invoked). 5) Run the script in a sandbox or inspect/modify it to remove hard-coded paths and to require explicit confirmation prompts. 6) Limit which credentials you store in the config (use an app-specific password with minimal scope) and restrict this skill's autonomous invocation until you’ve validated behavior. These inconsistencies are suspicious but not definitive proof of malicious intent — correct the mismatches and re-evaluate before granting broad permissions.

Type: OpenClaw Skill Name: se-gmail-monitor Version: 1.0.0 The skill provides high-risk email management capabilities (IMAP/SMTP access) and includes instructions in SKILL.md that allow the AI agent to send emails from a specific account ('Boris') without explicit user confirmation. Furthermore, the scripts/gmail-monitor.py script is incomplete, missing the 'read' and 'search' commands described in the documentation, and contains a hardcoded absolute file path (/Users/your-agent/) for its configuration file. These discrepancies and the inherent risks of automated email handling align with the criteria for a suspicious classification.