OpenClaw needs email access. That's exactly the problem.

The risk is real and documented

OpenClaw went from zero to 180,000 GitHub stars in weeks.¹ In that same period, security researchers found thousands of misconfigured instances leaking API keys, OAuth tokens, and credentials.² The platform's own creator warned: "Most non-techies should not install this. It's not finished."²

This isn't theoretical. Here's what happened in the first two weeks of 2026:

• 30,000+ exposed instances detected online, including deployments in healthcare, finance, and government²
• CVE-2026-25253 (CVSS 8.8) — a one-click remote code execution vulnerability that exploited the Control UI's trust of URL parameters. Attack chain executes in milliseconds.³
• 341 malicious skills (12% of the ClawHub marketplace) distributed keyloggers and credential stealers disguised as useful tools³
• The Moltbook breach exposed 35,000 email addresses and 1.5 million agent API tokens from a social network built for OpenClaw agents³

Why email is the most dangerous capability

Security researcher Simon Willison describes the "lethal trifecta" for AI agents: access to private data, exposure to untrusted content, and the ability to communicate externally.¹ Email hits all three.

When your OpenClaw agent has direct email access:

• Prompt injection via email: An incoming message with hidden instructions can trick your agent into forwarding sensitive data or sending unauthorized replies²
• Hallucinated sends: The agent misinterprets context and fires off an email you never intended — to a customer, investor, or vendor
• Supply chain attacks: A malicious skill from ClawHub could instruct your agent to exfiltrate data via email
• No undo button: Once an email sends, it's gone. You can't unsend a hallucinated apology to your biggest customer.

TextForge breaks the chain

TextForge sits between your OpenClaw agent and your Gmail. Your agent gets full email capability — reading threads, drafting replies, attaching files — but nothing sends without your approval.

• Every draft queued for review: Prompt injection, hallucination, or malicious skill — doesn't matter. You see every email before it goes out.
• Scoped API tokens: Your agent connects through TextForge's API, never touching your Gmail credentials directly. If a token is compromised, revoke it without changing your Google password.
• Full audit trail: Every draft, edit, approval, and rejection is logged. Know exactly what your agent tried to send and what you changed.
• Webhook loop: When recipients reply, your agent gets notified and drafts the next response. The approval cycle continues.

Five-minute setup

TextForge is an MCP server. OpenClaw supports MCP natively. Add it to your agent’s config and you’re done.

OpenClaw MCP configuration →

Official OpenClaw skill pack

The textforge-app/openclaw-textforge skill pack gives your agent the full TextForge workflow out of the box. It includes two skills:

• TextForge skill — All 23 MCP tools with complete parameter documentation, attachment upload patterns, and draft lifecycle guidance. Your agent knows exactly what to do without extra prompting.
• Email writing skill — Composition guide for AI-drafted email. Covers directness, specific language, binary question framing, HTML formatting rules, and a built-in audit for 12 common AI writing patterns (em dashes, synonym cycling, filler phrases, sycophantic openers). Drafts that read like a person wrote them — before they reach your approval queue.

How it works

---