Complete Zoho Mail integration with OAuth2, REST API (5-10x faster), Clawdbot /email commands, HTML emails, attachments, and batch operations. Security-harde...
Security Analysis
high confidenceThe skill's code, docs, and runtime instructions are internally consistent with a Zoho Mail integration; security issues called out in the repo appear to have been fixed and documented, with no evidence the skill asks for unrelated privileges.
Name/description match the included scripts and examples: Python-based Zoho Mail client, OAuth2 setup, REST API mode, Clawdbot command handlers and examples. Required binary (python3) is appropriate for this purpose and included examples map to described features.
SKILL.md instructs running included Python scripts, performing OAuth2 setup via a local browser callback, and placing token files under ~/.clawdbot. It only references Zoho endpoints and local callback ports; instructions do not ask the agent to read unrelated system files or exfiltrate data. Examples and handlers are all part of the repo and documented.
No install spec is provided (instruction-only install via clawhub), so nothing is pulled from arbitrary URLs at install time. The repository includes all code files required to run locally; dependencies are standard Python packages listed in requirements.txt.
The skill declares ZOHO_EMAIL and ZOHO_PASSWORD as required env vars and sets ZOHO_EMAIL as primaryEnv. OAuth2 is documented as the recommended (primary) auth method and tokens are stored in a local token file. Requiring ZOHO_PASSWORD as a mandatory env var is slightly misleading because OAuth2 can be used without an app password; consider making ZOHO_PASSWORD optional when OAuth2 token file is present. Otherwise requested secrets (email, app-password or OAuth tokens/Client ID & Secret during setup) are proportionate to the stated functionality.
always is false and the skill does not request system-wide changes. It stores tokens under the user's home (~/.clawdbot) and enforces 0600 permissions — normal for this type of integration. It does not modify other skills or system-wide agent settings.
Guidance
This repo appears to implement the described Zoho Mail features and documents and fixes past vulnerabilities. Before installing: prefer OAuth2 (follow oauth-setup.py) to avoid putting app passwords in environment variables; verify you actually need to set ZOHO_PASSWORD (it can be optional if using OAuth2/tokens); inspect and deploy the secure command handler (email-command-SECURE.js) if you expose /email commands to untrusted users; restrict bot command access and add rate-limiting/audit logging for any chat-exposed handlers; keep token files under ~/.clawdbot with 0600 permissions and do not commit them to version control. If you need higher assurance, review scripts/zoho-email.py and the Clawdbot handlers for any remaining subprocess usage in your deployment context.
Latest Release
v2.2.9
Docs: Fix clawhub/clawdhub naming inconsistencies — correct CLI name, slug, badge URL, and version references throughout README and SKILL.md
Popular Skills
Published by @briansmith80 on ClawHub
