41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill claims read-only (no-send) Gmail access via a brokered Composio layer, but the included code and registry metadata contain clear inconsistencies (notably an enabled GMAIL_SEND_EMAIL tool and...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1772475252485,
        "_id": "k978f417vbzy2z7hwwxvkeqvc5825c54",
        "changelog": "Initial release providing secure, read-only Gmail integration via Composio.\n\n- Read, search, and draft emails in Gmail while enforcing least-privilege access.\n- All API calls brokered through Composio; OAuth tokens are never exposed to the agent or local filesystem.\n- Sending and deleting emails are strictly blocked at the API gateway level.\n- Requires COMPOSIO_API_KEY and a connected Gmail account via app.composio.dev.\n- Designed for inbox checking, searching, summarizing, and safe draft creation only.",
        "changelogSource": "auto",
        "createdAt": 1772475252485,
        "version": "0.1.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "CoinVest AI Innovations",
        "handle": "coinvest518",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/39965431?v=4",
        "kind": "user",
        "linkedUserId": "kn78aac2yrfdzqmap0hjhgrac18203j8"
    },
    "ownerHandle": "coinvest518",
    "skill": {
        "_creationTime": 1772475252485,
        "_id": "kd77btfsw61eqhdc7m2456tt5x82462k",
        "badges": [],
        "createdAt": 1772475252485,
        "displayName": "Secure Gmail",
        "latestVersionId": "k978f417vbzy2z7hwwxvkeqvc5825c54",
        "ownerUserId": "kn78aac2yrfdzqmap0hjhgrac18203j8",
        "slug": "secure-gmail",
        "stats": {
            "comments": 0,
            "downloads": 243,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 1
        },
        "summary": "Secure Gmail skill using Composio brokered OAuth — no raw tokens stored locally. Reads, searches, and drafts emails with least-privilege enforcement. Blocks...",
        "tags": {
            "latest": "k978f417vbzy2z7hwwxvkeqvc5825c54"
        },
        "updatedAt": 1774328515326
    }
}