qq-mail-reader

读取QQ邮箱邮件。使用IMAP协议连接QQ邮箱，支持多种编码解析。触发场景：用户要求查看邮箱、读取邮件、查看最近邮件、筛选特定邮件等。

Security Scan

The skill's requests and instructions are coherent with its stated purpose (reading QQ Mail via IMAP); it asks for the expected credentials and provides IMAP-based code examples, with no unexpected installs or unrelated privileges.

Purpose & Capability

The skill is described as an IMAP-based QQ mailbox reader and requires MAIL_USER and MAIL_PASS plus a secrets file in ~/.openclaw/secrets/mail_qq.env. These requirements align with needing an email address and an IMAP authorization code to log in to imap.qq.com.

Instruction Scope

SKILL.md contains concrete Python IMAP usage and parsing/decoding routines that stay within the stated scope (connect, search, decode, extract body, filter). It does not instruct reading unrelated system files or contacting external endpoints beyond the IMAP server. It does instruct storing credentials in a local secrets file (expected for this use).

Install Mechanism

This is an instruction-only skill with no install spec and no code files. No packages or remote downloads are requested, so there is minimal install risk.

Credentials

Requesting MAIL_USER and MAIL_PASS (QQ IMAP authorization code) is proportionate to reading email, but these are highly sensitive credentials. The metadata also points to a specific local secrets file path. This is expected for an email reader, but users should treat the auth code as sensitive, store it with correct permissions (as the doc suggests), and only provide it to trusted agents.

Persistence & Privilege

always is false and the skill does not request persistent elevated privileges or modify other skills or system-wide agent settings. It only references its own secrets file and runtime env.

Assessment

This skill legitimately needs an email address and an IMAP authorization code to read your QQ mailbox. Before installing: (1) only provide an app-specific QQ IMAP authorization code (not your account password); (2) store the code in the indicated secrets file with strict permissions (chmod 600) and avoid committing it to source control; (3) be aware the skill will read email contents — only install if you trust the skill and the agent runtime; (4) prefer short-lived/rotated credentials when possible and monitor account activity; (5) if you need stronger isolation, consider running mailbox access in a separate environment or using a dedicated read-only mailbox.

QQ邮箱读取

通过 IMAP 协议读取 QQ 邮箱邮件。

触发条件

用户提到以下场景时使用：

• "查看邮箱"
• "读取邮件"
• "查看最近邮件"
• "查看当天邮件"
• "搜索邮件"
• "有新的邮件吗"

配置

需要提前配置 QQ 邮箱 IMAP：

1. 在 QQ 邮箱设置中开启 IMAP 服务
2. 创建授权码（不是登录密码）
3. 配置 secrets 文件：~/.openclaw/secrets/mail_qq.env

   MAIL_USER=[e-mail]
   MAIL_PASS=your_auth_code
   

安全注意事项

• 凭据文件必须设置权限为 600（仅所有者可读），防止其他用户读取敏感信息
• ~/.openclaw/secrets/ 目录默认已经被 gitignore，不会被提交到版本控制
• 不要将授权码提交到代码仓库或分享给他人

使用方法

1. 连接邮箱

import imaplib
import email
from email.header import decode_header

IMAP_HOST = 'imap.qq.com'
IMAP_PORT = 993

def connect_mail(user, password):
    mail = imaplib.IMAP4_SSL(IMAP_HOST, IMAP_PORT)
    mail.login(user, password)
    mail.select('INBOX')
    return mail

2. 搜索邮件

# 搜索最近7天的邮件
week_ago = (datetime.now() - timedelta(days=7)).strftime('%d-%b-%Y')
typ, msg_ids = mail.search(None, f'SINCE {week_ago}')

3. 解析邮件

def decode_header_value(header_value):
    """兼容多种编码的解码"""
    if not header_value:
        return ""
    decoded_parts = []
    for content, encoding in decode_header(header_value):
        if isinstance(content, bytes):
            try:
                decoded = content.decode(encoding if encoding else 'utf-8')
            except:
                # 尝试其他常见编码
                for enc in ['gbk', 'gb2312', 'utf-8', 'big5', 'latin1']:
                    try:
                        decoded = content.decode(enc)
                        break
                    except:
                        decoded = content.decode('utf-8', errors='ignore')
        else:
            decoded = str(content)
        decoded_parts.append(decoded)
    return ''.join(decoded_parts)

4. 提取正文

邮件正文可能包含 HTML，需要清理：

import re

def get_text_body(msg):
    body = ''
    if msg.is_multipart():
        for part in msg.walk():
            if part.get_content_type() == 'text/html':
                payload = part.get_payload(decode=True)
                encoding = part.get_content_charset() or 'utf-8'
                body = payload.decode(encoding, errors='ignore')
                break
    else:
        payload = msg.get_payload(decode=True)
        encoding = msg.get_content_charset() or 'utf-8'
        body = payload.decode(encoding, errors='ignore')
    
    # 清理HTML标签
    text = re.sub(r'<[^>]+>', ' ', body)
    text = text.replace('&nbsp;', ' ')
    text = text.replace('&amp;', '&')
    text = re.sub(r'\s+', ' ', text)
    return text

邮件过滤

根据用户需求过滤邮件，常见关键词类型：

• 通知类：通知、提醒、公告
• 业务类：订单、发货、支付
• 职位类：面试、邀请、邀约（仅当用户明确需要时）

注意事项

1. QQ 邮箱必须使用授权码登录，非登录密码
2. 邮件编码可能是 GBK/GB2312/UTF-8 等，需要多种编码尝试
3. IMAP 搜索不支持中文，使用 SINCE 获取所有邮件后本地过滤