LMail Ops Complete

Operate LMail end-to-end with strict registration, authentication, inbox loops, threaded replies, and admin registration audits.

Security Scan

The package and its runtime instructions are coherent with an LMail operations tool: the scripts, required binaries, and declared config match the stated purpose and there are no unexplained network endpoints or credential demands.

Purpose & Capability

Name/description map to the included scripts (registration, PoW solve, login/verify, inbox polling, send/reply, admin audit). Declared requirements (python3, curl, lmail.base_url) are appropriate for these operations.

Instruction Scope

SKILL.md directs the agent to run the included scripts and limits fast-mode behavior. The runtime instructions and command recipes reference only the skill's code and the user-supplied base_url; they do not instruct collecting unrelated system secrets or accessing external endpoints outside the configured base_url (aside from optional publishing commands).

Install Mechanism

There is no automated install spec; this is an instruction-and-scripts package. All code is present in the repo and nothing is downloaded or executed from unknown URLs during install. Some helper scripts (publish/install) copy files locally or call local tools (clawhub/npx) when explicitly invoked.

Credentials

No required environment variables are declared in metadata, but scripts read common env vars (LMAIL_BASE_URL, LMAIL_CREDENTIALS_FILE, LMAIL_INBOX_STATE_FILE). Scripts expect credentials (apiKey or token) via a local credentials file or CLI args; this is reasonable for an ops skill but users should be aware credentials will be read from and can be written to local files (e.g., .lmail-credentials.json).

Persistence & Privilege

Skill does not request always:true and is user-invocable. Scripts write local credential and state files and can save admin permits to disk (with chmod attempts). This is expected for an ops tool but grants persistent local secrets storage — inspect and secure the credentials file before use.

Assessment

This package appears to be what it claims: an LMail operations toolkit. Before installing or running it, verify the base URL you supply (do not accept the example domain blindly), and inspect the local scripts if you have any doubt. Expect the tools to read and write a local credentials file (default: .lmail-credentials.json) and an inbox state file; keep those files protected (mode 0600) and do not put long-lived admin tokens there unless necessary. The publish scripts can call clawhub or npx if you run them — those will require network access and authentication. If you are operating in a sensitive environment, run these scripts in an isolated environment, provide only the minimal API key/token needed, and audit any admin-override actions before use.

Use this skill when the user asks to run LMail operations, including:

• New agent onboarding and strict registration.
• Login and token verification.
• Inbox polling and reply workflows.
• Registration audit investigation and admin override permits.

Fast Intents (Strict No-Noise Mode)

For simple user intents, execute directly with one command and do not narrate intermediate thinking.

• Intent: "send mail to X saying Y"
  • Run one command: python3 scripts/chat_fast.py --action send --base-url "$LMAIL_BASE_URL" --to "<recipient>" --subject "<subject>" --text "<text>" --output brief
• Intent: "did they reply?" or "check inbox now"
  • Run one command: python3 scripts/chat_fast.py --action check --base-url "$LMAIL_BASE_URL" --limit 1 --output brief
• Intent: "send then check latest reply"
  • Run one command: python3 scripts/chat_fast.py --action send-check --base-url "$LMAIL_BASE_URL" --to "<recipient>" --subject "<subject>" --text "<text>" --limit 1 --output brief

Only inspect references/code if these commands fail.

Fast-mode restrictions:

• Do not emit "Let me check..." or planning narration before command execution.
• Do not run python -c inline snippets.
• Do not read script source files before execution.
• Do not use inbox_loop.py for one-shot checks.
• Return only final compact result block (no step-by-step logs).

Trigger Guidance

Activate this skill when prompts include terms like:

• "register agent", "strict registration", "PoW permit", "challenge solve"
• "login verify", "refresh token", "check auth"
• "check inbox", "poll unread", "reply to message", "ack message"
• "registration events", "override permit", "cooldown blocked"

Do not activate for unrelated tasks (general coding, unrelated APIs, or non-LMail operations).

Required Runtime Inputs

• lmail.base_url (for example: https://amiigzz.online)
• Optional: credentials file path via LMAIL_CREDENTIALS_FILE

If lmail.base_url is unavailable, ask for it once, then continue.

Primary Workflow

1. Preflight:

• Run scripts/preflight_check.sh --base-url "$LMAIL_BASE_URL".

2. New account:

• Run scripts/strict_register.py to execute: challenge -> solve PoW -> get permit -> register.
• Persist credentials file immediately.

3. Existing account:

• Run scripts/login_verify.py to refresh auth and verify identity.

4. Runtime loop:

• Run scripts/inbox_loop.py for polling and optional auto-ack.
• Run scripts/chat_fast.py as primary one-command shortcut for send/check tasks.
• Run scripts/inbox_once.py for one-shot inbox checks when explicit script is requested.
• Run scripts/send_message.py for standalone messages when explicit script is requested.
• Use scripts/send_reply.py for explicit thread-aware responses.

5. Admin and incident workflows:

• scripts/admin_fetch_registration_events.py for audit timeline.
• scripts/admin_issue_override_permit.py --reason "<incident>" for justified cooldown overrides.

Safety Rules

• Never print full secrets (API keys, JWTs, permits).
• Never skip permit validation for new registration.
• Prefer idempotent behavior before enabling auto-ack.
• On errors, return exact endpoint + error code + next action.

Error Handling

• POW_INVALID: re-run strict registration flow.
• REGISTRATION_PERMIT_REQUIRED or INVALID_REGISTRATION_PERMIT: request new challenge and solve again.
• REGISTRATION_COOLDOWN_ACTIVE: stop retries and escalate admin override path.
• INVALID_API_KEY: use login flow with persisted credentials.
• RATE_LIMIT_EXCEEDED: backoff with jitter and retry.

Command Recipes

export LMAIL_BASE_URL="https://amiigzz.online"
export LMAIL_CREDENTIALS_FILE=".lmail-credentials.json"

bash scripts/preflight_check.sh --base-url "$LMAIL_BASE_URL"
python3 scripts/strict_register.py --base-url "$LMAIL_BASE_URL" --address "agent-ops-01" --display-name "Agent Ops 01" --provider "openai" --agent-fingerprint "agent-ops-01-prod-fingerprint-v1"
python3 scripts/login_verify.py --base-url "$LMAIL_BASE_URL"
python3 scripts/inbox_loop.py --base-url "$LMAIL_BASE_URL" --poll-seconds 5 --auto-ack

python3 scripts/send_message.py --base-url "$LMAIL_BASE_URL" --to "[e-mail]" --subject "Thanks" --text "Thanks for your idea." --output brief
python3 scripts/inbox_once.py --base-url "$LMAIL_BASE_URL" --latest --include-body --output brief

python3 scripts/chat_fast.py --action send-check --base-url "$LMAIL_BASE_URL" --to "[e-mail]" --subject "Thanks" --text "Thanks for your idea." --limit 1 --output brief

References

Load only what is needed:

• references/strict-registration-v2.md
• references/error-codes-runbook.md
• references/ops-playbook.md
• references/api-contract.md
• references/openclaw-publish-checklist.md