📦 163
v1.2.1Email Skill - SMTP Sender 163email skill - 通过163 SMTP服务发送邮件，可自定义收件人、主题、正文。支持CLI与Python import
0· 19·0 当前·0 累计
by 安全扫描
OpenClaw
安全
high confidence该技能的代码、所需环境变量及运行时说明均与一个简单的 163 SMTP 邮件发送器相符；文件或说明中未发现任何异常或恶意内容。
评估建议
This skill is a small, self-contained SMTP email sender; the requested env vars (your 163 address and SMTP auth code) are appropriate for its function. Before installing: 1) Only use an account you trust the skill with (consider a dedicated throwaway/sender account), 2) Treat CLAW_EMAIL_AUTH as a secret and rotate it if exposed, 3) Review the code (it’s short) to confirm behaviour matches expectations, and 4) Note the package/source has no homepage and an unknown owner — while the code appears l...详细分析 ▾
✓ 用途与能力
Name/description, required binary (python), and requested env vars (CLAW_EMAIL, CLAW_EMAIL_AUTH) match the declared purpose of sending mail via 163 SMTP. The code implements SMTP_SSL login and sendmail to smtp.163.com as expected. Minor metadata/version mismatch across files (registry 1.2.1 vs SKILL.md and skill.json 1.2.0) but this is a bookkeeping issue, not a security one.
✓ 指令范围
SKILL.md only instructs setting the email credentials and running the Python module or CLI. The runtime code uses only standard-library smtplib/email and environment variables; it does not read unrelated files or exfiltrate data to unexpected endpoints. The README and examples suggest editing/setting env vars but do not request extra system access.
✓ 安装机制
No install spec (instruction-only install), and included code is pure Python relying on the standard library. This is low-risk compared with remote downloads or package installs.
ℹ 凭证需求
The skill requires two environment variables (CLAW_EMAIL, CLAW_EMAIL_AUTH) which are appropriate for SMTP authentication. SKILL.md also documents optional CLAW_SMTP_SERVER and CLAW_SMTP_PORT (not listed in the manifest env array) — a minor inconsistency but not a security issue. Treat CLAW_EMAIL_AUTH as a secret (SMTP auth code) and provide least-privilege credentials.
✓ 持久化与权限
Skill is not always-enabled and is user-invocable. It does not modify other skills or system-wide settings. Note: the platform default allows autonomous invocation, but this skill has no extra persistence or elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.12026/4/20
更新显示名称以提高搜索可见性
● 无害
安装命令
点击复制官方npx clawhub@latest install 163email-skill
镜像加速npx clawhub@latest install 163email-skill --registry https://cn.longxiaskill.com