Skulk Email

Email via DreamHost — read inbox, send email, search messages. Send works from any VPS (including DigitalOcean) by routing through DreamHost's Roundcube webm...

This skill is consistent with its description, but keep these practical safety points in mind: - The script requires storing your mailbox password in plaintext in ~/.config/skulk-email/credentials.json. Ensure the directory (700) and file (600) permissions are applied and only use on machines you trust. Consider using an account with limited privileges or an app-specific password where supported. - The send flow automates a webmail login and scrapes tokens; it stores cookies in /tmp and attempts to clean them up on exit, but if the process is killed (SIGKILL) cookies may remain temporarily. Don’t run on multi-user systems where /tmp is shared without appropriate protections. - Webmail automation can be brittle (changes to the Roundcube UI could break it) and may run afoul of provider rate limits or terms of service if abused; avoid bulk sending and respect DreamHost/Gmail policies. - If you need stronger security, consider using an OAuth/app-password approach for Gmail and avoid storing long-lived plaintext passwords. - If you want additional assurance, review the script yourself or run it in a sandbox/VPS you control before linking any production mailbox.

Type: OpenClaw Skill Name: skulk-email Version: 1.0.2 The skill provides legitimate email functionality via IMAP and DreamHost Roundcube webmail automation to bypass SMTP blocks. However, it contains a security vulnerability in `scripts/skulk-email.sh` where sensitive email credentials (passwords) are passed as plaintext command-line arguments to a Python subprocess, making them visible to other users on the system via the process list. It also stores session cookies in the shared `/tmp` directory. While these appear to be unintentional design flaws rather than malicious intent, they represent a risk to credential confidentiality.