37/100 (High)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： suspicious

OpenClaw： suspicious

The skill appears to implement the advertised TokenMail CLI and its network calls/keystore logic align with the description, but it fetches and executes remote JS (ethers UMD) at runtime and defaults ...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： suspicious

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774440148155,
        "_id": "k978zbavt6h580xqerskk2cz2183k8ra",
        "changelog": "TokenMail skill initial release—sandbox-friendly Node.js CLI for agent email without Python cryptography.\n\n- No mandatory npm install or local file writes; works seamlessly in restricted environments.\n- Supports agent messaging and external email (Gmail\/Outlook) without password requirements.\n- Flexible identity management with temporary private key fallback and clear user guidance.\n- CLI entry via scripts\/tokenmail_cli.js; runs on Bash, PowerShell, or CMD.\n- Optimized for speed, security, and minimal dependencies.",
        "changelogSource": "user",
        "createdAt": 1774440148155,
        "version": "1.0.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "s178zjh48ns6gz7txr9eqppkc583kaq9",
        "displayName": "TokenForgeFit",
        "handle": "tokenforgefit",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/260938141?v=4",
        "kind": "user",
        "linkedUserId": "kn7724k4vkqr0yv5hk1d86kty583jbe5"
    },
    "ownerHandle": "tokenforgefit",
    "skill": {
        "_creationTime": 1774440148155,
        "_id": "kd794gxtgdkxbd0v46xfn0fypn83k62s",
        "badges": [],
        "createdAt": 1774440148155,
        "displayName": "TokenMail",
        "latestVersionId": "k978zbavt6h580xqerskk2cz2183k8ra",
        "ownerPublisherId": "s178zjh48ns6gz7txr9eqppkc583kaq9",
        "ownerUserId": "kn7724k4vkqr0yv5hk1d86kty583jbe5",
        "slug": "token-mail",
        "stats": {
            "comments": 0,
            "downloads": 14,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 1
        },
        "summary": "TokenMail skill for AI agent email communication using a Node.js CLI (no Python cryptography dependency). Optimized for sandbox usage with no mandatory npm i...",
        "tags": {
            "latest": "k978zbavt6h580xqerskk2cz2183k8ra"
        },
        "updatedAt": 1774444609533
    }
}