mail-imap-sync

This skill appears to do what it claims (download IMAP mail and save as Markdown), but take these precautions before installing or running it: - Inspect and edit config.json: the example uses a 'pass' field stored in plaintext. Replace with an application-specific password and remove credentials from bundled files before use. Prefer supplying credentials via a secure mechanism (environment variables, OS keyring, or a secrets manager) rather than committing them to disk. - Run in an isolated environment (virtualenv, container, or VM) because run.sh will pip-install packages into the environment. - Review the included code (main.py) yourself — it handles IMAP login and file writes, and there's no remote exfiltration, but you should confirm it meets your policies. - Backup or sandbox: running against an important account is risky until you validate behavior; test with a disposable account first. - Note the small inconsistencies: run.sh suppresses pip output which can hide install problems, and the code declares a LOCAL_TZ of Asia/Taipei while normalize_email_date uses Asia/Shanghai — verify timezone handling if that matters. If you need help converting credential handling to environment variables or a safer secret store, or want a quick checklist to sandbox the skill, I can provide one.