sixel-email

This skill appears to do only what it says: use the sixel.email API to send and receive messages for a single operator. Before installing, verify the following: 1) Confirm the SIXEL_API_TOKEN you receive is scoped to only the intended agent/inbox and understand its lifetime/permissions; never reuse broad or long-lived credentials. 2) Validate the SIXEL_API_URL (the SKILL.md references https://sixel.email/v1) and confirm the service's reputation and HTTPS/TLS configuration. 3) The docs assume jq is available for the background poller — either install jq or adapt the poller; ensure the poller runs in a restricted environment so it cannot be used to exfiltrate unrelated data. 4) The poller writes to /tmp and downloads attachments — follow the doc's advice: use a dedicated download directory, sanitize filenames, and avoid writing to user-supplied paths. 5) Clarify how the poller should “notify your agent” so the agent does not gain access to unintended files or system state. 6) Because the registry entry has no homepage listed but SKILL.md references https://sixel.email, consider verifying the service URL and the skill author (owner ID) out-of-band if you need a higher trust level. If any of these points are concerning or the token appears to have broader scope than a single-inbox token, treat the installation as risky and do not proceed until clarified.