nmail

Things to check before installing or enabling this skill: - Verify binary provenance: the registry metadata contains no install spec even though a full Go source tree is included and README suggests 'brew' or 'go install'. If you will run a prebuilt nmail binary, obtain it from a trusted source (official GitHub release or build the source yourself and inspect it). Do not run an unverified binary. - Credentials: nmail stores app passwords in ~/.nmail/config.yaml (0600). That is expected for an email client but is sensitive. If possible, prefer using system keychain storage or ensure the agent process is trusted and the config file is protected. - Declared dependencies mismatch: SKILL.md shows piping watch output into the external 'openclaw' CLI, but the skill metadata does not declare that binary as required. If an agent automates this, ensure the openclaw CLI used is the one you expect. - Build & review: because source is present, consider auditing or building the Go code locally and verifying behavior (especially config file handling and network connections to IMAP/SMTP hosts) before granting runtime access. - If you need lower blast radius: run the nmail binary in an isolated environment (container or dedicated agent role) and avoid giving the agent access to unrelated files or credentials. Given the inconsistencies (missing install spec, undeclared binaries, plaintext config), proceed only after verifying the binary/source and considering how app passwords are stored.