Mediator

This package mostly does what it says (monitor local mail/iMessage, summarize via an LLM, and log results), but several red flags deserve attention before you run it: - Hard-coded defaults: The init template includes specific Gmail addresses. Remove or replace these immediately—don't leave someone else's addresses in your config. - External dependencies: The code calls an external script (~/clawd/scripts/gog-read.sh), the imsg CLI, and an 'llm' CLI. Inspect or replace those tools before use. The skill will only be as safe as those dependencies. - Data leakage to LLMs: summarize.py invokes an 'llm' CLI which will forward message content to whatever model/backend your local CLI is configured to use. If you care about confidentiality, verify the llm CLI configuration (where API keys point, provider privacy), or modify the code to use an on-device model or to avoid sending full messages. - Automatic installs: The scripts will pip-install PyYAML at runtime if missing. If you prefer controlled installs, install dependencies yourself first. - Auto-respond risks: The configuration supports an 'auto' respond mode but the code doesn't implement sending responses; enabling auto-response in any integrated system without reviewing behavior would be dangerous. Prefer 'draft' mode and manual review. - Inspect and sandbox: Before running, read the external gog-read.sh and any 'imsg' or 'llm' CLI you have installed. Run the skill in a limited/sandboxed environment or on a test account to confirm behavior. Consider removing or redacting any example accounts in the init template. If you want to proceed, verify the external CLIs and where the LLM sends data, remove the hard-coded accounts, and test with non-sensitive data first.