📦 Gmail Litiao — 管理邮件
v1.0.0通过托管 OAuth 接入 Gmail API，一站式读取、发送与管理邮件、会话、标签及草稿，安全高效完成邮箱自动化操作。
0· 180·1 当前·1 累计
by @litiao1224下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears to do what it says: it routes Gmail API calls through Maton's gateway and requires a MATON_API_KEY. Before installing, verify the Maton service and domain (maton.ai) are trustworthy and that you expect a third party to be able to exchange OAuth tokens for your Gmail account. Check the OAuth scopes that will be requested when you open the connect URL, and prefer least-privilege scopes. Investigate the metadata mismatch (_meta.json ownerId/slug/version differ from registry metad...详细分析 ▾
ℹ 用途与能力
The name/description claim Gmail API access via managed OAuth and the SKILL.md exclusively documents calling Maton endpoints (gateway.maton.ai, ctrl.maton.ai, connect.maton.ai) using MATON_API_KEY. Requiring a Maton API key is proportionate to that stated purpose. However, repository/packaging metadata (_meta.json) and registry metadata differ (different ownerId, slug and version numbers), and the source/homepage are unknown — this mismatch is a packaging/attribution concern that should be checked.
✓ 指令范围
SKILL.md contains only examples and instructions to call the Maton gateway and control endpoints using the MATON_API_KEY and to complete OAuth via a returned URL. It does not instruct the agent to read arbitrary local files, unrelated env vars, or transmit data to unexpected domains beyond the Maton service and Google's proxied API endpoints.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files for execution. That minimizes filesystem/write risk; nothing is downloaded or installed by the skill itself.
ℹ 凭证需求
Only one environment variable is required (MATON_API_KEY), which is coherent for a proxied OAuth gateway. Be aware that this single key likely enables the Maton service to access your Google connections and act on your behalf (read/send email, manage labels/drafts). The sensitivity of that single variable is therefore high and should be treated accordingly.
✓ 持久化与权限
The skill does not request always:true and does not include install-time behavior that modifies other skills or system-wide config. The agent may invoke the skill autonomously (default), which is expected behavior but worth noting because the MATON_API_KEY would be used whenever the skill is invoked.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/17
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install gmail-litiao
镜像加速npx clawhub@latest install gmail-litiao --registry https://cn.longxiaskill.com