email-sender-policy 安全扫描报告 — 可信 | ClawSafe

5 /100

email-sender-policy

邮件发送政策管理员，自动应用UTF-8编码、表格转清单、RFC 822格式

Legitimate email formatting and sending skill that performs all documented functions (RFC 2047 encoding, Markdown table conversion, Gmail API integration) without malicious behavior.

技能名称email-sender-policy

分析耗时29.6s

引擎pi

✓

可以安装

Approve for use. This skill has no security concerns - it reads local files and sends emails via a documented API gateway as declared.

安全发现 1 项

严重性	安全发现	位置
低危	Dead child_process import 文档欺骗 execSync is imported from child_process but never called. This is dead code that could theoretically be activated, but poses no current risk. `const { execSync } = require('child_process');` → Remove unused import for cleaner code	`index.js:215`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`READ`	✓ 一致	index.js:219 - fs.readFileSync(args.file)
网络访问	`NONE`	`WRITE`	✓ 一致	index.js:170-183 - POST to gateway.maton.ai for Gmail API

8 项发现

🔗

中危外部 URL 外部 URL

https://maton.ai/settings

README.md:41

🔗

中危外部 URL 外部 URL

https://ctrl.maton.ai/connections

README.md:43

🔗

中危外部 URL 外部 URL

https://gateway.maton.ai/google-mail/gmail/v1/users/me/messages/send

SKILL.md:94

📧

提示邮箱邮箱地址

[email protected]

README.md:54

📧

提示邮箱邮箱地址

[email protected]

README.md:54

📧

提示邮箱邮箱地址

[email protected]

README.md:57

📧

提示邮箱邮箱地址

[email protected]

README.md:60

📧

提示邮箱邮箱地址

[email protected]

README.md:200

目录结构

8 文件 · 26.0 KB · 997 行

Markdown 5f · 613L JavaScript 2f · 366L JSON 1f · 18L

├─ 📋 _meta.json JSON 18L · 469 B

├─ 📝 article.md Markdown 56L · 3.3 KB

├─ 📜 index.js JavaScript 320L · 8.3 KB

├─ 📝 README.md Markdown 260L · 5.8 KB

├─ 📝 SKILL.md Markdown 269L · 6.4 KB

├─ 📜 test_format.js JavaScript 46L · 1.1 KB

├─ 📝 test_newsletter.md Markdown 19L · 523 B

└─ 📝 test_table.md Markdown 9L · 213 B

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`node (runtime)`	`required`	runtime	否	No npm package dependencies - uses native Node.js modules

安全亮点

✓ All functionality declared in SKILL.md is implemented correctly

✓ MATON_API_KEY credential access is declared in _meta.json

✓ No credential exfiltration - API key used only for Gmail API authentication

✓ No base64 decoding piped to shell execution

✓ No suspicious network connections to unknown IPs

✓ No file writes outside of documented behavior

✓ Test mode available to verify format without sending

✓ RFC 2047/822 compliant email formatting