Manage your tuta.com account

Send, read, and manage emails via Tuta (formerly Tutanota) encrypted email service. Use when user asks to send emails, check inbox, read mail, or do any emai...

This skill mostly does what it says (a Tuta client), but there are multiple red flags you should resolve before installing: 1) The registry metadata does not declare the TUTA_EMAIL/TUTA_PASSWORD env vars or the config path even though SKILL.md instructs you to store credentials in openclaw.json — ask the publisher to correct the metadata. 2) The script and instructions persist decrypted keys and the passphrase_key in a session JSON file; avoid storing plaintext credentials or decrypted keys where other processes or users can read them. 3) The SKILL.md suggests pip-installing crypto libraries; review those installs and prefer using a virtualenv or sandboxed environment. 4) The included Python file (as provided) contains a likely syntax/truncation error during session loading — ask for a clean, reviewed release and verify the code before running. 5) Because this uses an undocumented API, the client may break or behave unexpectedly; prefer official/ documented integrations when possible. If you still want to use it, test in an isolated environment, don't reuse your primary password (consider app-specific password if supported), and request that the author: (a) declare required env/config in the registry metadata, (b) remove writing raw decrypted keys to disk or protect them with OS-level permissions/encryption, and (c) provide a signed, reviewed release.

Type: OpenClaw Skill Name: tutacom Version: 1.0.0 The skill bundle provides a functional, well-implemented client for the Tuta (formerly Tutanota) encrypted email service. The Python script `scripts/tuta_client.py` correctly implements Tuta's specific end-to-end encryption protocol, including key derivation (bcrypt/argon2) and AES/HMAC operations, and interacts only with the legitimate Tuta API endpoint (app.tuta.com). While it handles sensitive credentials and session keys, it follows security best practices such as setting restrictive file permissions (0600) on session files and lacks any indicators of data exfiltration, obfuscation, or malicious intent.