outlook-mail-reader — 读Outlook邮件
v1.0.0通过MCP chrome-devtools协议驱动本地Chrome，自动查询Outlook邮件，支持按日期跳转、筛选与搜索。需提前开启Chrome远程调试（127.0.0.1:9222或18800）并完成chrome-devtools-mcp配置。
0· 64·0 当前·0 累计
by 下载技能包
最后更新
2026/4/2
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill can legitimately control your browser to read Outlook, but it requires two sensitive actions: enabling Chrome remote debugging (127.0.0.1:9222) and adding an OpenClaw gateway entry that runs 'npx chrome-devtools-mcp@latest'. Those steps give whatever runs via MCP broad, persistent access to all browser tabs and content and will dynamically fetch code from npm. Before installing: back up ~/.openclaw/openclaw.json; prefer pinning a specific, reviewed package version instead of '@latest'...详细分析 ▾
ℹ 用途与能力
The skill's stated purpose—controlling a local Chrome DevTools connection to read Outlook mail—matches the instructions and tool calls (chrome-devtools__* and browser actions). However the SKILL.md requires adding an MCP server entry that runs 'npx chrome-devtools-mcp@latest' inside the OpenClaw gateway config, which is not strictly part of reading mail but is required to enable the MCP plumbing. That requirement is explainable but notable.
⚠ 指令范围
Instructions ask the user to edit the global OpenClaw config (~/.openclaw/openclaw.json) to add the 'mcp' section and to enable Chrome remote debugging. Modifying agent/gateway config and enabling 127.0.0.1:9222 gives the skill (and any code that is connected) the ability to inspect and interact with all open browser tabs and page content — much broader than 'only Outlook'. The runtime steps instruct reading snapshots and clicking/filling any page elements, which could be used to access or exfiltrate other sensitive pages if present.
⚠ 安装机制
There is no formal install spec in the registry, but the documentation explicitly tells the user to configure OpenClaw to run 'npx chrome-devtools-mcp@latest --autoConnect'. That causes dynamic fetching and execution of the latest package from the npm registry each time or when the gateway starts — a supply-chain risk. The skill does not recommend pinning a version or verifying the package, increasing risk.
⚠ 凭证需求
The skill requests no environment variables or credentials, which sounds safe, but enabling Chrome remote debugging and adding the MCP entry effectively grants the skill access to the user's local browser state (all tabs, DOM, possibly cookies, and other sensitive data). That level of access is substantially broader than 'read Outlook mail' and is not constrained by the instructions.
⚠ 持久化与权限
While always:false and the skill is user-invocable, the required manual change to OpenClaw's global config is a persistent modification that affects the gateway and could enable other skills or components to connect to the browser. The SKILL.md warns not to modify other fields, but adding the mcp entry still grants ongoing capability until removed — a persistent privilege with platform-wide implications.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install outlook-mail-reader
镜像加速npx clawhub@latest install outlook-mail-reader --registry https://cn.longxiaskill.com镜像同步中