Xobni Email

Email infrastructure for AI agents via Xobni.ai. Provides real email addresses (@xobni.ai) with REST API and MCP server access. Use when an AI agent needs to send/receive email, search inbox, manage attachments, or set up webhooks for email notifications.

This skill appears to implement an email API and is coherent with that purpose, but metadata failed to declare the primary API credential. Before installing: (1) verify the service domain (https://xobni.ai) and that you trust the operator, (2) expect to provide an agent-scoped API key (check that the registry entry is updated to declare something like XOBNI_KEY or a primaryEnv), (3) only give a scoped key limited to the specific agent and rotate/revoke keys when done, (4) if you configure webhooks, ensure your endpoint verifies X-Xobni-Signature HMAC and only accepts deliveries from trusted IPs, (5) confirm attachment size/limits and privacy implications of sending email content to a third-party service. The omission of declared credentials is likely an oversight but merits caution; require the publisher to correct metadata before trusting automated/long-running usage.

Type: OpenClaw Skill Name: xobni Version: 1.0.1 The skill bundle is classified as suspicious due to its inherent capabilities that, while legitimate for an email service, present significant risks if an AI agent using this skill is compromised via prompt injection. Specifically, the skill allows sending emails with base64-encoded attachments and creating webhooks to arbitrary URLs, as detailed in SKILL.md and references/api.md. These features could be abused by a malicious prompt to exfiltrate sensitive local files or email metadata to an attacker-controlled endpoint. There is no evidence of intentional malice within the skill's instructions or code, but the exposed capabilities are high-risk.