Commune — Agent Email Inbox

This skill appears to implement what it claims — an agent-native email API — but there are a few red flags you should address before installing: 1) Registry metadata incorrectly says no env vars are required, but the CLI and docs require COMMUNE_API_KEY — treat that as required. 2) The source/homepage are missing; verify the publisher and the official project (commune.email) before trusting the key or installing packages. 3) INSTALL.md asks you to pip install commune-mail / commune-mcp and references raw GitHub tarball installs; confirm those packages/repositories are legitimate on PyPI/GitHub to avoid supply-chain risks. 4) The CLI looks for credentials.json in several common locations — avoid storing unrelated secrets in those locations and prefer setting COMMUNE_API_KEY as an environment variable with least privilege. 5) Because the skill can send arbitrary emails, test it in an isolated environment, review webhook handling (verify HMAC secrets), and avoid using high-privilege or long-lived keys until you confirm the service and packages are authentic. If you can, ask the publisher for a canonical source repository or homepage and verify the PyPI package names and GitHub repo before proceeding.