Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/secrets/pass-resolver.js:6
- Evidence
* argv[] by spawn(), but tight input validation is a cheap second line of
Security audit
Openclaw Channel Imap
Security checks for vulnerabilities and agentic risk
Overview
This appears to be what it claims: an IMAP/SMTP email channel plugin, though it runs real code and will use whatever mailbox credentials you configure.
Before installing, understand that this plugin gives OpenClaw access to read a configured mailbox and send replies through the configured SMTP account. That matches its purpose, but it is powerful: use a dedicated mailbox, prefer a restricted secret reference such as `pass` entries for only the mail passwords, keep the allowlist/rate-limit/authentication checks enabled where possible, and avoid giving the mail-facing agent broad tools or sensitive memory. Also verify the npm package metadata/scripts if you install it manually, because the registry entry has no explicit install spec even though the package contains executable code.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/secrets/pass-resolver.ts:8
- Evidence
* argv[] by spawn(), but tight input validation is a cheap second line of
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/connection/imap-connection.js:27
- Evidence
password: [REDACTED],
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/gateway/resolve-account.js:28
- Evidence
password: [REDACTED](imapRaw.password, `imap.password for account ${accountId}`),
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/smtp/sent-folder-writer.js:29
- Evidence
password: [REDACTED],
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/connection/imap-connection.ts:52
- Evidence
password: [REDACTED],
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/gateway/resolve-account.ts:35
- Evidence
password: [REDACTED](imapRaw.password, `imap.password for account ${accountId}`),
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/smtp/sent-folder-writer.ts:54
- Evidence
password: [REDACTED],