ClawHub

imap-smtp-email

v0.0.13

Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Sup...

⭐ 92· 38.6k·412 current·430 all-time
by@gzlicanyi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (read/send email via IMAP/SMTP) match the requested env vars (IMAP_* and SMTP_*), required binaries (node, npm), and included scripts (imap.js, smtp.js, config.js). Requiring SMTP and IMAP credentials is proportionate to the stated purpose.
ℹ
Instruction Scope
SKILL.md and setup.sh instruct the agent to write a persistent config at ~/.config/imap-smtp-email/.env and to run npm install and the skill's node scripts. The runtime scripts only connect to IMAP/SMTP servers provided by the user, read/write attachments restricted by ALLOWED_READ_DIRS/ALLOWED_WRITE_DIRS, and send a test email to the configured address. Note: credentials are stored in plaintext in the .env file (file permissions are set to 600).
ℹ
Install Mechanism
No external download URLs; installation is via npm (setup.sh runs npm install in the skill directory). Installing npm packages is expected for a Node-based skill but carries the usual supply-chain risk of npm dependencies. The install method is proportionate to the implementation.
✓
Credentials
Requested environment variables (IMAP_HOST/USER/PASS and SMTP_HOST/USER/PASS) are exactly what an IMAP/SMTP tool needs. The primaryEnv (SMTP_PASS) is reasonable. One caveat: credentials are persisted to ~/.config/imap-smtp-email/.env in plaintext (though setup.sh sets permissions to 600).
✓
Persistence & Privilege
The skill creates and reads its own config at ~/.config/imap-smtp-email/.env and can persist account data; always:false (no forced global inclusion). It does not modify other skills or system-wide agent settings. Autonomy (skill can be invoked by the agent) is default behavior and not by itself a concern.
Assessment
This skill appears to do what it says: it will store IMAP/SMTP credentials in ~/.config/imap-smtp-email/.env (file mode 600) and will connect to whatever mail servers you configure. Before installing: 1) Prefer app-specific or limited-scope passwords (e.g., Gmail App Password) rather than your main account password. 2) Limit ALLOWED_READ_DIRS and ALLOWED_WRITE_DIRS to only directories you want the skill to access (avoid broad defaults if you have sensitive files). 3) Be aware npm install will run and pull dependencies from the public registry (normal for Node but a supply-chain consideration). 4) If you need stronger protection for credentials, consider using a separate dedicated mailbox/account for automated access rather than your primary email. If any of that is unacceptable, do not install.

Like a lobster shell, security has layers — review code before you run it.

latestvk972w61k5ra4ffg1ftz85qx9sn84wpjy

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📧 Clawdis
Binsnode, npm
EnvIMAP_HOST, IMAP_USER, IMAP_PASS, SMTP_HOST, SMTP_USER, SMTP_PASS
Primary envSMTP_PASS

Comments