ClawHub

zmail

v0.1.2

Local-first email for agents: IMAP sync to maildir + SQLite (FTS5); CLI search, read, thread, who, attachments. Requires Node 20+, npm install (`npm install...

⭐ 0· 104·0 current·0 all-time
byLew Cirne@cirne
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description (local-first IMAP sync, SQLite FTS5 index, CLI search/read/ask) match the declared requirements: Node/npm, the zmail CLI, IMAP credentials, and an OpenAI key for 'ask'/'inbox' features. Nothing unrelated is requested.
ℹ
Instruction Scope
SKILL.md instructs the agent to install and run the zmail CLI, create a local cache under ~/.zmail, and (optionally) send email-derived content to OpenAI or third-party 'enrich' APIs for certain commands. Those network calls are explicitly described as optional, but they do mean email content may leave the device when using those commands—this is within the stated purpose but is a privacy-sensitive action the user/agent must opt into.
ℹ
Install Mechanism
No install spec in registry (instruction-only), but SKILL.md tells users to run `npm install -g @cirne/zmail` or `npx @cirne/zmail`. That's a standard npm-based install; it also uses native better-sqlite3 which can rebuild a native addon on first run. That build step can execute code during compilation and may require toolchain access—expected for this project but worth noting.
ℹ
Credentials
Required config/env (ZMAIL_EMAIL, ZMAIL_IMAP_PASSWORD, ZMAIL_OPENAI_API_KEY or OPENAI_API_KEY) are proportionate to an IMAP-sync tool with optional OpenAI features. However, the registry summary at the top lists “Required env vars: none” while the SKILL.md and openclaw.requires declare the three env variables—this metadata mismatch is an incoherence to fix before trusting UI-level permission prompts.
✓
Persistence & Privilege
Skill is instruction-only and not always-enabled; it does not request elevated platform persistence. It stores config and a local mail cache under ~/.zmail (documented) which is appropriate for its functionality.
Assessment
This skill appears to do what it says: a local IMAP sync + SQLite index with a CLI and optional OpenAI-powered commands. Before installing: 1) Decide whether you are comfortable with email-derived content being sent to OpenAI (used by `zmail ask`, `zmail inbox`, and optionally `who --enrich`); sensitive mail should not be sent unless you accept that. 2) Prefer `npx @cirne/zmail` for one-off use or inspect the npm package source at https://github.com/cirne/zmail before global install. 3) Be aware the native better-sqlite3 addon may rebuild/compile on first run (requires build tools and will execute build scripts). 4) Protect ~/.zmail/.env (file permissions, backups) since it stores credentials. 5) Note the registry metadata mismatch: the top-level metadata says no env vars required while SKILL.md clearly needs ZMAIL_EMAIL, ZMAIL_IMAP_PASSWORD, and an OpenAI key—verify the UI will request/secure those values before proceeding.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d42j0ntceryxzx863ttd7y583pbt0

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsnode, npm, zmail
ConfigZMAIL_EMAIL, ZMAIL_IMAP_PASSWORD, ZMAIL_OPENAI_API_KEY

Comments