email skill
v1.0.0Manage and read emails via the mailbox CLI with JSON outputs, supporting listing, showing, deleting, and monitoring emails securely and efficiently.
⭐ 1· 1.7k·1 current·1 all-time
by郭立lee@leeguooooo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md describes an email-management CLI (mailbox CLI) and therefore the skill's purpose matches its runtime actions. However, the skill metadata lists no required config paths or credentials while the instructions explicitly require credentials at ~/.config/mailbox/auth.json and a global npm package; that mismatch is inconsistent and unexplained.
Instruction Scope
Instructions are narrowly scoped to running the mailbox CLI and checking JSON outputs, which fits an email management skill. They do instruct the agent to rely on credentials stored at a specific local path (~/.config/mailbox/auth.json), which is outside the declared manifest and should have been declared.
Install Mechanism
This is an instruction-only skill (no install spec). SKILL.md requires `npm install -g mailbox-cli`, but the manifest provides no install instructions or provenance for that package. Global npm installation of an unvetted package is a non-trivial risk and should be specified and audited in the manifest.
Credentials
The skill requests access to local credentials (the auth.json path) but the registry metadata lists no required config paths or primary credential. Requiring a credentials file is reasonable for an email tool, but it must be declared; the omission is an inconsistency that could hide sensitive access.
Persistence & Privilege
The skill does not request 'always: true' or other elevated persistence, and there are no install scripts or code files that would persist or modify other skills. Autonomous invocation is allowed (platform default), which is normal for skills.
What to consider before installing
Do not install blindly. Before enabling this skill: (1) Ask the publisher to update the manifest to declare the required config path (~/.config/mailbox/auth.json) and any primary credential. (2) Verify the mailbox-cli npm package source (project repo, maintainers, release artifacts) — avoid running `npm install -g` for an unreviewed package. (3) Inspect the contents of ~/.config/mailbox/auth.json to understand what tokens/credentials would be exposed to the agent. (4) Prefer running the CLI in an isolated environment or container and require explicit confirmation for destructive operations; confirm the skill uses --dry-run by default and requires --confirm and --account-id for deletes. If the publisher cannot justify or correct the missing manifest entries, treat the skill as high risk and avoid installing.Like a lobster shell, security has layers — review code before you run it.
latestvk971deewfmtm4w3y86ztz9c4vx80f0x2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.