PortEden - secured email (Gmail, Outlook, Exchange) access for OpenClaw

Secured Email Mnagement - Gmail, Outlook & Exchange - list, search, read, send, reply, forward, delete, and modify emails across multiple accounts (gog-cli s...

Security Scan

The skill's requirements and instructions are consistent with a CLI-based email management tool: it needs the porteden binary and an API key and the SKILL.md stays within that scope.

Purpose & Capability

The name/description (email management across Gmail/Outlook/Exchange) matches the declared requirements: a 'porteden' CLI binary and a PE_API_KEY. The listed optional env vars (PE_PROFILE, PE_TIMEZONE, etc.) are reasonable for a multi-account CLI. Nothing in the manifest requests unrelated services or credentials.

Instruction Scope

SKILL.md directs the agent to run the porteden CLI, perform browser or token login, and use stored credentials in the system keyring. This is within expected scope, but note that the CLI (when invoked) will access your email providers and local keyring; flags like --include-body or --all will fetch fuller or larger sets of email data.

Install Mechanism

Install options are brew (porteden/tap/porteden) or go install from github.com/porteden/cli — both are standard ways to install a CLI. The brew formula is a third‑party tap (porteden/tap) rather than core/homebrew; verify the tap and the upstream GitHub repo before installing.

Credentials

The only required env var is PE_API_KEY (declared as primaryEnv) which is appropriate for an API-backed CLI. The additional env vars listed are optional configuration. There are no unrelated credentials required.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It notes credentials persist in the system keyring (expected for convenience). Autonomous invocation is allowed by default on the platform but is not a new privilege introduced by this skill.

Assessment

This skill appears coherent for a CLI email client, but take these precautions before installing: 1) Verify the porteden project (homepage and GitHub repo) and the brew tap to ensure you trust the upstream authors. 2) Prefer browser login (stored in system keyring) over exporting PE_API_KEY into shared environment variables. 3) If you must set PE_API_KEY, avoid placing it in shells or CI environments where others can read it. 4) Consider verifying the installed binary (checksums or signed release) and inspect the GitHub repo if you can. 5) Be conscious when invoking flags like --include-body or --all that retrieve full message bodies or large datasets. 6) If you do not want agents to access your email autonomously, do not enable the skill for autonomous use (or disable agent invocation in your agent settings).

porteden email

Use porteden email (alias: porteden mail) for email management across multiple accounts. Use -jc flags for AI-optimized output.

If porteden is not installed: brew install porteden/tap/porteden (or go install github.com/porteden/cli/cmd/porteden@latest).

Setup (once)

• Browser login (recommended): porteden auth login — opens browser, credentials stored in system keyring
• Direct token: porteden auth login --token <key> — stored in system keyring
• Verify: porteden auth status
• If PE_API_KEY is set in the environment, the CLI uses it automatically (no login needed).

Common commands

• List emails (or --today, --yesterday, --week, --days N): porteden email messages -jc
• Filter emails: porteden email messages --from [e-mail] -jc (also: --to, --subject, --label, --unread, --has-attachment)
• Search emails: porteden email messages -q "keyword" --today -jc
• Custom date range: porteden email messages --after 2026-02-01 --before 2026-02-07 -jc
• All emails (auto-pagination): porteden email messages --week --all -jc
• Get single email: porteden email message <emailId> -jc
• Get thread: porteden email thread <threadId> -jc
• Send email: porteden email send --to [e-mail] --subject "Hi" --body "Hello" (also: --cc, --bcc, --body-file, --body-type text, --importance high)
• Send with named recipient: porteden email send --to "John Doe <[e-mail]>" --subject "Hi" --body "Hello"
• Reply: porteden email reply <emailId> --body "Thanks" (add --reply-all for reply all)
• Forward: porteden email forward <emailId> --to [e-mail] (optional --body "FYI", --cc)
• Modify email: porteden email modify <emailId> --mark-read (also: --mark-unread, --add-labels IMPORTANT, --remove-labels INBOX)
• Delete email: porteden email delete <emailId>

Notes

• Credentials persist in the system keyring after login. No repeated auth needed.
• Set PE_PROFILE=work to avoid repeating --profile.
• -jc is shorthand for --json --compact: strips attachment details, truncates body previews, limits labels, reduces tokens.
• Use --all to auto-fetch all pages; check hasMore and nextPageToken in JSON output.
• Email IDs are provider-prefixed (e.g., google:abc123, m365:xyz789). Pass them as-is.
• --include-body on messages fetches full body (default: preview only). Single message includes body by default.
• --body and --body-file are mutually exclusive. Use --body-type text for plain text (default: html).
• Confirm before sending, replying, forwarding, or deleting emails.
• Environment variables: PE_API_KEY, PE_PROFILE, PE_TIMEZONE, PE_FORMAT, PE_COLOR, PE_VERBOSE.