imap-idle
Enables event-driven email monitoring with IMAP IDLE protocol, providing instant notifications and reducing token usage.
Install this skill
Security score
The imap-idle skill was audited on Feb 9, 2026 and we found 41 security issues across 4 threat categories, including 14 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 256 | curl -X POST http://127.0.0.1:18789/hooks/wake \ |
Webhook reference - potential data exfiltration
| 3 | description: Event-driven email monitoring using IMAP IDLE protocol. Replaces polling with instant push notifications via OpenClaw webhooks. Use when setting up email monitoring, replacing hourly emai |
Webhook reference - potential data exfiltration
| 28 | ### 1. Enable OpenClaw Webhooks |
Webhook reference - potential data exfiltration
| 66 | - OpenClaw webhook URL and token |
Webhook reference - potential data exfiltration
| 116 | "webhook_url": "http://127.0.0.1:18789/hooks/wake", |
Webhook reference - potential data exfiltration
| 117 | "webhook_token": "your-webhook-token", |
Webhook reference - potential data exfiltration
| 127 | - `webhook_url` - OpenClaw webhook endpoint |
Webhook reference - potential data exfiltration
| 128 | - `webhook_token` - Webhook authentication token (from openclaw.json) |
Webhook reference - potential data exfiltration
| 132 | - `debounce_seconds` - Batch events for N seconds before webhook (default: 10 sec) |
Webhook reference - potential data exfiltration
| 186 | 6. **Webhook**: Sends batched events via webhook (single or grouped) |
Webhook reference - potential data exfiltration
| 191 | - **Debouncing**: Batches emails for 10 seconds before webhook to prevent flooding during spikes (e.g., GitHub mention storms) |
Webhook reference - potential data exfiltration
| 193 | - **UID Tracking**: Tracks last processed message UID per account to prevent duplicate webhooks |
Webhook reference - potential data exfiltration
| 244 | **Duplicate webhooks:** |
Webhook reference - potential data exfiltration
| 253 | **No webhooks triggering:** |
Webhook reference - potential data exfiltration
| 254 | - Test webhook manually: |
Access to hidden dotfiles in home directory
| 30 | Edit `~/.openclaw/openclaw.json`: |
Access to hidden dotfiles in home directory
| 103 | Config file: `~/.openclaw/imap-idle.json` |
Access to hidden dotfiles in home directory
| 118 | "log_file": "~/.openclaw/logs/imap-idle.log", |
Access to hidden dotfiles in home directory
| 162 | # Edit ~/.openclaw/imap-idle.json and remove "password" field |
Access to hidden dotfiles in home directory
| 240 | - Check config file exists: `cat ~/.openclaw/imap-idle.json` |
Access to system keychain/keyring
| 50 | **Optional but recommended:** Install keyring for secure password storage: |
Access to system keychain/keyring
| 53 | pip3 install keyring --user --break-system-packages |
Access to system keychain/keyring
| 56 | With keyring, passwords are stored in your system's secure keychain (macOS Keychain, GNOME Keyring, etc.) instead of plain text in config files. |
Access to system keychain/keyring
| 134 | ## Secure Password Storage (Keyring) |
Access to system keychain/keyring
| 136 | **🔐 Recommended:** Store passwords in system keychain instead of config file. |
Access to system keychain/keyring
| 138 | ### Setup with Keyring |
Access to system keychain/keyring
| 140 | When you run `./imap-idle setup`, the wizard will ask if you want to use keyring. If you say yes: |
Access to system keychain/keyring
| 141 | - Passwords are stored in your system's secure keychain |
Access to system keychain/keyring
| 143 | - Keyring uses OS-level encryption |
Access to system keychain/keyring
| 145 | ### Manual Keyring Setup |
Access to system keychain/keyring
| 147 | If you already have a config with plain text passwords, migrate to keyring: |
Access to system keychain/keyring
| 150 | # Install keyring |
Access to system keychain/keyring
| 151 | pip3 install keyring --user --break-system-packages |
Access to system keychain/keyring
| 155 | import keyring, getpass |
Access to system keychain/keyring
| 158 | keyring.set_password('imap-idle', username, password) |
Access to system keychain/keyring
| 165 | ### How Keyring Works |
Access to system keychain/keyring
| 167 | The listener automatically tries keyring first, then falls back to config: |
Access to system keychain/keyring
| 168 | 1. Try `keyring.get_password('imap-idle', username)` |
Access to system keychain/keyring
| 175 | - ✅ OS-level encryption (macOS Keychain, GNOME Keyring, Windows Credential Manager) |
External URL reference
| 116 | "webhook_url": "http://127.0.0.1:18789/hooks/wake", |
External URL reference
| 256 | curl -X POST http://127.0.0.1:18789/hooks/wake \ |