WeCom邮箱

企业微信邮箱操作 - 使用专用邮箱发送邮件。 支持读取会议纪要、业务文档等作为邮件内容发送。

This skill performs the advertised task (send corporate email) but the SKILL.md tells the agent to read and decode local credential files while the metadata lists no required credentials — that's a mismatch you should not ignore. Before installing or enabling: 1) Ask the publisher which exact credential/config path(s) the skill will access and require that to be declared in metadata. 2) Ensure the SMTP account is a dedicated, restricted mailbox (not your primary personal account). 3) Require the skill to prompt for explicit user consent every time before reading any local file or sending an email. 4) Prefer short-lived or minimum-permission credentials (or an API-based integration) instead of storing reusable secrets in plaintext/base64. 5) If the skill is from an unknown source, test in a sandboxed environment and verify the credential files referenced exist and contain only the intended mailbox credentials. If the author cannot clearly justify the credential paths and access controls, treat the skill as unsafe to enable.

Type: OpenClaw Skill Name: wecom-email Version: 1.0.0 The skill provides explicit instructions for the AI agent to locate and decode sensitive credential files stored in the workspace memory (e.g., `~/.openclaw/workspace/memory/sc-email-credentials.enc`) using `base64 -d`. While the stated purpose is sending enterprise emails via legitimate WeCom SMTP servers, the inclusion of specific paths to multiple credential stores and instructions on how to bypass their encoding poses a significant risk of credential exposure or unauthorized access to sensitive files.