Email Registration Scanner

This skill appears to do what it claims (scan email headers for registration/welcome messages), but before installing or running it, be aware of these practical risks and mitigations: - Do not pass passwords on the command line. The example runs python3 imap_scan.py --password "..." which exposes the secret to other local users (ps) and shell history. Prefer using the agent's Secret Store, an interactive prompt, or an in-memory mechanism that doesn't show passwords in process arguments. - The SKILL.md says temp files will be deleted, but the helper script writes a JSON file and does not delete it. If you run this, point output to a secure location you control, and securely delete the file when done (or modify the script to delete it after use). - Proton Mail requires the Bridge running locally; confirm you trust the Bridge instance and local environment before exposing bridge credentials. - Consider using Gmail connector/MCP rather than raw app passwords where available, since MCP may provide a safer auth flow. - Review and, if appropriate, revoke any app-specific passwords after the scan completes. If you want to proceed, either (1) request the author to fix the CLI example to use the Secret Store / prompt-based input and to implement secure deletion of temp files, or (2) run the included script locally with careful handling of secrets (stdin/prompt or environment variable not exposed to other users) and explicit secure cleanup of output files.