Ravi inbox

Read incoming SMS or email messages — OTPs, verification codes, verification links, incoming mail. Do NOT use for sending email (use ravi-email-send) or mana...

Security Scan

The skill's purpose (reading SMS/email OTPs) matches its instructions, but the SKILL.md assumes the presence of an authenticated 'ravi' CLI and access to inbox credentials while the package metadata declares no required binaries or credentials — that mismatch is concerning.

Purpose & Capability

The README-style instructions clearly implement an inbox reader via the 'ravi' CLI (ravi inbox sms/email, ravi message ...). However, the skill metadata lists no required binaries and no primary credential/environment variables. Real usage requires the 'ravi' command-line tool and an authenticated Ravi identity (credentials or token), which are not declared in the registry metadata — an incoherence between stated requirements and runtime instructions.

Instruction Scope

SKILL.md stays on-topic: it only instructs listing and reading SMS/email messages and gives shell recipes to extract OTPs/links. It does not direct reading unrelated files or exfiltrating data to third-party endpoints. It does rely on running shell commands (ravi, jq, grep, sleep) which is expected for a CLI-driven skill but expands the agent's ability to run arbitrary local commands.

Install Mechanism

There is no install spec and no code files (instruction-only), which minimizes installation risk. However, because runtime usage depends on an external 'ravi' binary, the absence of a declared required-binaries list or an install instruction is a notable omission (see purpose_capability).

Credentials

The skill will need access to inbox credentials (an authenticated Ravi identity, tokens, or local CLI session) to read messages, but no environment variables, secrets, or config paths are declared. Lack of declared credentials reduces transparency about what secrets the agent will need or access.

Persistence & Privilege

The skill does not request always:true and is not installing persistent components. It relies on invoking local CLI commands at runtime; autonomous invocation of the skill is possible by default but that is normal platform behavior and not, by itself, a red flag.

What to consider before installing

This skill appears to do what it says (read SMS/email OTPs and links), but the SKILL.md assumes you have and are logged into a 'ravi' CLI while the metadata declares no required binaries or credentials. Before installing or enabling: (1) verify you have the 'ravi' CLI installed and understand which account/session it will use; (2) confirm how the Ravi CLI stores auth (local tokens, files, env vars) so you know what the agent could access; (3) consider running the suggested 'ravi' commands yourself to confirm output and safety; (4) prefer the skill only if you trust the Ravi identity and are comfortable the agent can read sensitive OTPs/links; (5) ask the publisher to update metadata to declare the required binary and any credentials or to provide an explicit install/auth workflow. If you want extra caution, restrict autonomous invocation or require manual approval before the agent runs system commands.

Read SMS and email messages received at your Ravi identity. Use this after triggering verifications, 2FA, or when expecting incoming messages.

SMS (OTPs, verification codes)

# List SMS conversations (grouped by sender)
ravi inbox sms --json

# Only conversations with unread messages
ravi inbox sms --unread --json

# View a specific conversation (all messages)
ravi inbox sms <conversation_id> --json
# conversation_id format: {phone_id}_{from_number}, e.g. "1_+15559876543"

JSON shape — conversation list:

[{
  "conversation_id": "1_+15559876543",
  "from_number": "[phone]",
  "phone_number": "[phone]",
  "preview": "Your code is 847291",
  "message_count": 3,
  "unread_count": 1,
  "latest_message_dt": "2026-02-25T10:30:00Z"
}]

JSON shape — conversation detail:

{
  "conversation_id": "1_+15559876543",
  "from_number": "[phone]",
  "messages": [
    {"id": 42, "body": "Your code is 847291", "direction": "incoming", "is_read": false, "created_dt": "..."}
  ]
}

Email (verification links, confirmations)

# List email threads
ravi inbox email --json

# Only threads with unread messages
ravi inbox email --unread --json

# View a specific thread (all messages with full content)
ravi inbox email <thread_id> --json

JSON shape — thread detail:

{
  "thread_id": "abc123",
  "subject": "Verify your email",
  "messages": [
    {
      "id": 10,
      "from_email": "[e-mail]",
      "to_email": "[e-mail]",
      "subject": "Verify your email",
      "text_content": "Click here to verify: https://example.com/verify?token=xyz",
      "direction": "incoming",
      "is_read": false,
      "created_dt": "..."
    }
  ]
}

Individual Messages (flat, not grouped)

Use these when you need messages by ID rather than by conversation:

ravi message sms --json              # All SMS messages
ravi message sms --unread --json     # Unread only
ravi message sms <message_id> --json # Specific message

ravi message email --json              # All email messages
ravi message email --unread --json     # Unread only
ravi message email <message_id> --json # Specific message

Quick Recipes

Extract an OTP code from SMS

ravi inbox sms --unread --json | jq -r '.[].preview' | grep -oE '[0-9]{4,8}'

Extract a verification link from email

THREAD_ID=$(ravi inbox email --unread --json | jq -r '.[0].thread_id')
ravi inbox email "$THREAD_ID" --json | jq -r '.messages[].text_content' | grep -oE 'https?://[^ ]+'

Important Notes

• Poll, don't rush — SMS/email delivery takes 2-10 seconds. Use sleep 5 before checking.
• Auto-contacts — Ravi automatically creates or updates contacts when you send or receive email/SMS. Use ravi contacts search to look up people you've interacted with.
• Always use --json — human-readable output is not designed for parsing.

Related Skills

• ravi-email-send — Reply, reply-all, or forward emails you've read
• ravi-email-writing — Write professional replies with proper formatting and tone
• ravi-contacts — Look up a sender's name or details from their email/phone
• ravi-login — End-to-end signup/login workflows that use inbox for OTP extraction
• ravi-feedback — Report inbox delivery issues or suggest improvements