Skills/ClawHub/imap-smtp-email

imap-smtp-email@0.0.19

CAUTION· install only

Publisher claims: "Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Supports multiple accounts. Works with any IMAP/SMTP server including Gmail, Outlook, 163.com, vip.163.com, 126.com, vip.126.com, 188.com, and vip" Observed in sandbox: reads credential files.

Registry ClawHubPublisher gzlicanyi · publishing for 115 daysInstalls 51,478Last detonated 35 h ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-11 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: reads credential files.

Behavior trace

Honeypot run · 4 s · 2 scenarios
t+CategoryObserved action
1.7sfilesystemread ~/.npmrc
1.7sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/55/be/db95d59eeb8b6af2001cb68e24c4a331b6a5d6842939aae8e62f4c28ba49 · ~/.npm/_cacache/index-v5/68/23/3e59b340c2311416cb1061ace0f16cb9d6b6bb464634a6cc904c6f85b3eb · ~/.npm/_cacache/index-v5/3d/91/a8d36fb0b77024638470c9116f5113e903526c18f65fa7afd1a79ee7d526 · ~/.npm/_cacache/index-v5/04/70/1cdff0348b19fdf2ba56e9214835e81c2d85b52fcab8e5795594ee94642f · ~/.npm/_cacache/index-v5/05/88/31c78e59dd7819a6c289eab96e52e31e13bec690f6aa74382d9d84d0696f outside project
1.7sfilesystemwrote ~/.npm/_cacache/tmp/10fc0415 · ~/.npm/_cacache/tmp/ff6f90f4 · ~/.npm/_cacache/tmp/59e8ef42 · ~/.npm/_cacache/tmp/34182c3c · ~/.npm/_cacache/tmp/f27bb872 · ~/.npm/_cacache/tmp/e879125c
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmjs.org:443
1.7snetworkCONNECT tcp://registry.npmmirror.com:443 · not in the allow-list, refused
1.7sprocessexec /usr/bin/dirname
1.7sprocessexec /usr/local/bin/npm
1.7sprocessexited 1: npm error A complete log of this run can be found in: /tmp/ks-detonate-gpfq28/setup/home/.npm/_logs/2026-11-11T01_04_00_639Z-debug-0.log
1.7sprocessscript backend runs setup only
1.7sprocessscript backend runs setup only
2.4sprocesssecond launch, clock +45 days, CI unset
3.7sfilesystemread ~/.npmrc
3.7sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/content-v2/sha512/c8/41/210ae0a2e70455ed9e5955ff6257681632f519a8a26102cd5e70574a274ab36f26957a59ac1374236006a67a17e9f4528b8996ca95d77e8e4946dced0b7c · ~/.npm/_cacache/content-v2/sha512/41/7a/3e3bf4242cfff1d67ca2e78b90886d17ace0f1772b2e42f13976d56abfb1792b641be85b0dfaa6ebe8a845e70436d2d7dc577550a74ff6c757b531148f5a · ~/.npm/_cacache/content-v2/sha512/01/10/c99a986676f524e86970ef2f434366c590a047c101cb8b696c687e8f3e6cff29af6c14e06c065ba8ce10e5b569a7bfdbbf705e91b7cef39d14cf57eca9fc · ~/.npm/_cacache/content-v2/sha512/7a/fd/90cd2cd63d89b2f46baa7c856295d03839d7062de15942bab9cace91b62b85f914108995abf1364dc8072e557c904587c43be32ca01ff506e41584e26ea1 · ~/.npm/_cacache/content-v2/sha512/a9/0a/cfb582cb2e5d76345e03accf42bdf93191823def139be5db271991c4ded785af4b5688467d51d80c3dccefdb8be5ef4f1c60ca5eea6197187ae8b48a7707 outside project
3.7sfilesystemwrote ~/.npm/_cacache/tmp/5279afee · ~/.npm/_cacache/tmp/0d69e081 · ~/.npm/_cacache/tmp/bee617c3 · ~/.npm/_cacache/tmp/7d82959c · ~/.npm/_cacache/index-v5/79/82/d015c0e676e4c03cd0f87e145daf74f635765071a6240f6c1123ac89f38a · ~/.npm/_cacache/index-v5/23/b8/c6285d55772ecc212e69007d1374120c7167f5d7e3bf62967e9f7903b426
3.7snetworkCONNECT tcp://registry.npmjs.org:443
3.7snetworkCONNECT tcp://registry.npmmirror.com:443 · not in the allow-list, refused
3.7snetworkCONNECT tcp://registry.npmjs.org:443
3.7snetworkCONNECT tcp://registry.npmjs.org:443
3.7snetworkCONNECT tcp://registry.npmjs.org:443
3.7sprocessexec /usr/bin/dirname
3.7sprocessexec /usr/local/bin/npm
3.7sprocessexited 1: npm error A complete log of this run can be found in: /tmp/ks-detonate-gpfq28/later/home/.npm/_logs/2026-12-26T01_04_03_027Z-debug-0.log

Static findings

HIGH
Access to sensitive file pathsSKILL.md:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesIf you have an existing `~/.config/imap-smtp-email/.env`, it takes priority over the shared config. The format is:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/config.js:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst FALLBACK_ENV_PATH = path.resolve(__dirname, '../.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/config.js:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst LEGACY_ENV_PATH = path.join(os.homedir(), '.config', 'imap-smtp-email', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/config.js:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst SHARED_ENV_PATH = path.join(os.homedir(), '.config', 'mail-skills', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…npm install --production ``` Configuration is stored at `~/.config/mail-skills/.env` (shared with caldav-sync skill, survives skill updates). If no shared config i…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/config.js:282 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.error(`Error: Account "${accountName}" not found. Check ~/.config/imap-smtp-email/.env or ~/.config/mail-skills/.env`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/config.js:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.error(`Error: Account "${prefix.toLowerCase()}" not found in config. Check ~/.config/imap-smtp-email/.env`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesOr manually add prefixed variables to `~/.config/mail-skills/.env`:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/imap.js:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthrow new Error('ALLOWED_WRITE_DIRS not set in .env. Attachment download is disabled.');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup.sh:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSHARED_CONFIG_FILE="$SHARED_CONFIG_DIR/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsetup.sh:321 · File permission modification command — agent changes file ownership/permissionschmod 600 "$CONFIG_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/migrate-legacy-config.js:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Escape a value for safe .env writing: wrap in double quotes if it containsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/migrate-legacy-config.js:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to the shared ~/.config/mail-skills/.env (PROVIDER/USERNAME/PASSWORD format).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/migrate-legacy-config.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Migrate a legacy ~/.config/imap-smtp-email/.env (IMAP_HOST/IMAP_USER/... format)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/imap.js:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthrow new Error('Missing IMAP user or password. Check your config at ~/.config/imap-smtp-email/.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/smtp.js:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthrow new Error('Missing SMTP configuration. Check your config at ~/.config/imap-smtp-email/.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsetup.sh:62 · File permission modification command — agent changes file ownership/permissionschmod 600 "$SHARED_CONFIG_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssetup.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Migrate via a node script that parses the legacy .env with dotenv.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup.sh:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesLEGACY_CONFIG_FILE="$LEGACY_CONFIG_DIR/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:319 · npx invocation of non-well-known package — may execute untrusted codenpx skills add https://github.com/gzlicanyi/mail-skills -s caldav-syncFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssetup.sh:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Writes to shared config: ~/.config/mail-skills/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/smtp.js:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthrow new Error('ALLOWED_READ_DIRS not set in .env. File read operations are disabled.');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈2,593 tok
1 file · 11 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.npmrc.
  2. Unclaimed publisher≈ +8 on the totalClaim gzlicanyi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim gzlicanyiPropose a patch to the maintainer