mailbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow for this skill is to call the bundled mailbox CLI (via OpenClaw) which ingests and returns email content/headers from the user’s IMAP accounts (outsider-authored text: other people’s emails) into the agent-visible JSON context (e.g., email list/search/show fields like subject, from, and body/preview).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill/docs tree for literal, high-entropy credentials. Most credential-like strings are clearly placeholders (e.g., OPENAI_API_KEY, sk-xxx, your-key, API_SECRET_KEY, 1234, example passwords) and I ignored those per the rules.

However I found a repeating, fully-formed Feishu/Lark webhook URL: https://open.larksuite.com/open-apis/bot/v2/hook/a56c9638-cb65-4f95-bb11-9eb19e09692a

Why this is flagged:

• It is a full webhook URL containing a long UUID-like token. Webhook URLs are bearer endpoints that can be used to post messages to a chat; that makes them usable credentials (they grant access to send messages).
• The token portion is high-entropy and literal in the docs (not a "YOUR_XYZ" placeholder).
• Even if included as an example, this exact, usable-looking URL appears repeatedly in example and template files — if it were a real active webhook it would be a secret that should not be published.

What I explicitly ignored:

• OPENAI_API_KEY, sk-xxx, sk-..., "your-key", "your-secret", "123456:ABC-DEF" or other obvious placeholders and simple example passwords found throughout the docs (these match the "Documentation Placeholders" and "Obvious Examples" rules).

Recommendation: Treat the Feishu/Lark webhook URL as sensitive (rotate/revoke it if it is/was real), and replace with a placeholder like FEISHU_WEBHOOK="https://open.larksuite.com/open-apis/bot/v2/hook/YOUR_WEBHOOK_HERE" in docs.