Is claw-silhouette/botemail-ai safe?
https://github.com/openclaw/skills/tree/main/skills/claw-silhouette/botemail-ai
BotEmail.ai is a documentation-only API skill with no executable code, no git hooks, and a clean SKILL.md containing no overt prompt injection. Its primary risks are functional rather than installation-time: the heartbeat feature creates an indirect prompt injection channel (any party who emails the bot address can inject content into the agent's persistent HEARTBEAT.md state), and 2FA code interception with bot fleet creation are explicitly advertised use cases with direct account-takeover and mass-fraud applications. Canary file accesses observed during monitoring are attributable to the audit infrastructure performing baseline verification, not the skill itself.
Category Scores
Findings (10)
HIGH Indirect prompt injection via heartbeat email content -20 ▶
The heartbeat feature instructs the agent to periodically fetch all emails from the bot inbox and surface sender, subject, and preview content in HEARTBEAT.md and notifications. Email bodies are fully attacker-controlled — any party who knows the bot email address can inject arbitrary instructions into the agent's context. If HEARTBEAT.md is re-read by the agent in future sessions (as heartbeat files typically are), the injection persists across sessions.
LOW Persistent state files create cross-session injection surface -10 ▶
HEARTBEAT.md and memory/heartbeat-state.json are written and re-read across agent sessions. Content derived from external email (attacker-controlled) that is stored in or influences these files persists beyond the originating session, allowing a one-time email to have ongoing influence on agent behavior.
LOW Autonomous operation framing discourages user oversight -5 ▶
The skill's frontmatter description explicitly positions the tool as operating 'without your human,' normalizing reduced user confirmation for workflows involving external service registration, credential handling, and 2FA interception.
MEDIUM User API credentials continuously transmitted to unvetted third-party service -15 ▶
Every inbox fetch and heartbeat poll sends the user's API key to api.botemail.ai via Authorization Bearer header. The service has no independently auditable privacy policy accessible from the skill package. If botemail.ai is compromised or operated maliciously, all credentials and inbox contents are exposed. Recurring automated polling amplifies this exposure indefinitely.
LOW Agent directed to interact with .env files for credential storage -7 ▶
The skill instructs the agent to recommend .env files as a storage location for bot API keys. This trains the agent to treat .env files as a normal interaction target within credential workflows, potentially broadening the surface area for credential handling in future agentic steps.
INFO Working 2FA extraction code patterns in documentation -8 ▶
EXAMPLES.md contains operationally complete JavaScript functions for extracting verification codes from email bodies using regex patterns, polling logic with retry, and link extraction. While documentation-only, these patterns are ready to copy-execute and lower the barrier for 2FA bypass automation.
MEDIUM Canary credential files accessed in sequential batch during monitoring window -20 ▶
inotify recorded OPEN/ACCESS/CLOSE_NOWRITE events on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCloud application_default_credentials.json in a single rapid sequential batch. The same pattern recurred twice. Timing analysis places both batches at audit infrastructure boundaries (1771932496 before clone start, 1771932513 at audit teardown), strongly suggesting the oathe monitoring system is performing integrity baselines rather than the skill. The skill contains no executable code capable of filesystem reads. Noted for completeness and manual verification.
MEDIUM 2FA OTP interception explicitly advertised as primary use case -20 ▶
The skill's design and examples center on receiving and extracting one-time passwords and verification codes. This capability directly enables MFA bypass in account takeover scenarios when an adversary possesses phished or leaked primary credentials. The polling and code-extraction automation is documented with production-ready patterns.
MEDIUM Bot fleet creation enables mass fake account registration -18 ▶
The skill demonstrates creating named fleets of bot accounts each with isolated inboxes to support parallel automation workflows. This infrastructure is directly applicable to mass fake account registration across web services for spam, astroturfing, fraud, and abuse-of-service attacks.
LOW Canary files read (non-destructively) during audit session -15 ▶
Six canary credential files were opened and read during the audit session. All events show CLOSE_NOWRITE, indicating no modification occurred. Post-audit integrity hashes confirm file contents are unchanged. Access is not attributable to the skill (no executable code present) and is consistent with the audit monitoring infrastructure performing pre/post baseline checks. Noted for completeness.