nmail

Command-line tool to send, read, and manage Korean Naver and Daum emails via nmail with JSON outputs and account configuration.

Security Scan

The skill appears to be a legitimate CLI for Naver/Daum email, but there are several mismatches between the manifest, SKILL.md, and metadata (notably missing install/binary declarations and plaintext credential storage) that you should review before installing.

Purpose & Capability

The name/description match the code: a CLI for Naver/Daum IMAP/SMTP. However the package metadata claims 'instruction-only' with no required binaries, while SKILL.md requires the nmail binary in PATH and the repository includes full source code. README suggests brew/go installs yet no install spec is present in the registry metadata. This mismatch (source present but no install declared, binaries required but not listed) is inconsistent and worth verifying.

Instruction Scope

SKILL.md instructions are scoped to adding accounts, listing inbox, reading/sending/searching mail, and optionally piping watch output into an OpenClaw system event. The doc explicitly tells users/agents to store app passwords via `nmail config add` and documents that app passwords are saved in ~/.nmail/config.yaml. It also shows integration using an external `openclaw` CLI. The instructions do not request unrelated files or hidden endpoints, but they do instruct the agent to handle sensitive credentials and to call an external 'openclaw' command that is not declared in the skill metadata.

Install Mechanism

No install spec is provided in the registry entry despite source files and README claiming install options (brew / go install / clawhub). Because the skill includes source but does not declare how the binary will be installed, the operator or agent would need to build or fetch a binary manually. Building/executing unverified binaries from source or installing a binary from an unspecified source increases risk if you don't control the build/install step.

Credentials

The skill requests no environment variables and does not demand unrelated credentials. However, it persistently stores account passwords (app passwords) in plaintext YAML at ~/.nmail/config.yaml (per code and SKILL.md). That is proportionate to an email client but is sensitive: installing this skill and running the provided commands will place credentials on disk in a local file. Also SKILL.md references piping into `openclaw` (another binary) which is not declared as a required dependency.

Persistence & Privilege

The skill does not request 'always: true' and does not modify other skills or system-wide agent settings. Autonomous invocation is allowed (the platform default) but not an additional red flag here. The primary persistence is local config (~/.nmail/config.yaml) which is normal for an email client.

What to consider before installing

Things to check before installing or enabling this skill: - Verify binary provenance: the registry metadata contains no install spec even though a full Go source tree is included and README suggests 'brew' or 'go install'. If you will run a prebuilt nmail binary, obtain it from a trusted source (official GitHub release or build the source yourself and inspect it). Do not run an unverified binary. - Credentials: nmail stores app passwords in ~/.nmail/config.yaml (0600). That is expected for an email client but is sensitive. If possible, prefer using system keychain storage or ensure the agent process is trusted and the config file is protected. - Declared dependencies mismatch: SKILL.md shows piping watch output into the external 'openclaw' CLI, but the skill metadata does not declare that binary as required. If an agent automates this, ensure the openclaw CLI used is the one you expect. - Build & review: because source is present, consider auditing or building the Go code locally and verifying behavior (especially config file handling and network connections to IMAP/SMTP hosts) before granting runtime access. - If you need lower blast radius: run the nmail binary in an isolated environment (container or dedicated agent role) and avoid giving the agent access to unrelated files or credentials. Given the inconsistencies (missing install spec, undeclared binaries, plaintext config), proceed only after verifying the binary/source and considering how app passwords are stored.

nmail — Korean Email CLI Skill

한국 이메일(네이버, 다음) CLI. 에이전트가 이메일을 읽고 보내기 위한 도구.

Prerequisites

• nmail binary in PATH (go install github.com/harlock/nmail@latest)
• 계정 설정 완료 (nmail config add)

Setup

# 네이버 계정 추가 (앱 비밀번호 필요)
nmail config add --provider naver --email <email> --password <app-password>

# 다음 계정
nmail config add --provider daum --email <email> --password <app-password>

# 설정 확인
nmail config list

Commands

받은편지함 확인

# 최근 20개 (JSON)
nmail inbox

# 개수 지정
nmail inbox --limit 5

# 사람이 읽기 편한 형태
nmail inbox --pretty

JSON 출력 예시:

[
  {"id": 42, "from": "[e-mail]", "subject": "안녕", "date": "2026-03-19T10:00:00+09:00", "is_read": false},
  {"id": 41, "from": "[e-mail]", "subject": "알림", "date": "2026-03-19T09:30:00+09:00", "is_read": true}
]

메일 읽기

# ID로 본문 읽기 (inbox에서 확인한 id)
nmail read 42

# 사람용
nmail read 42 --pretty

메일 보내기

# 직접 본문
nmail send --to [e-mail] --subject "제목" --body "내용"

# 파일에서 본문
nmail send --to [e-mail] --subject "제목" --body-file ./message.txt

# stdin으로 본문
echo "파이프로 보내기" | nmail send --to [e-mail] --subject "제목" --body-file -

메일 검색

# 보낸사람으로 검색
nmail search --from "socra"

# 조합 검색
nmail search --subject "코딩" --since 2026-03-01 --limit 10

# 안 읽은 것만
nmail search --unseen

# 본문+제목 전체 검색
nmail search --text "키워드"

새 메일 감시

# 폴링 모드 (5초 간격) — JSON line 출력
nmail watch --poll 5

# 사람용
nmail watch --poll 5 --pretty
# 📬 New: [제목] from 보낸사람

⚠️ 네이버 IMAP은 IDLE 미지원. --poll 사용 필수.

계정 관리

nmail config list          # 계정 목록
nmail config add ...       # 계정 추가
nmail config remove --email <email>  # 계정 삭제

Agent Usage Patterns

새 메일 확인 → 요약

nmail inbox --limit 5
# → JSON 파싱 → is_read: false인 것만 필터 → read로 본문 확인 → 요약

메일 검색

nmail search --from "socra" --since 2026-03-01
# → JSON 파싱 → 원하는 메일 찾기

실시간 감시 (OpenClaw 연동)

# watch 출력을 openclaw system event로 파이프
nmail watch --poll 10 | while IFS= read -r line; do
  subj=$(echo "$line" | jq -r '.subject')
  from=$(echo "$line" | jq -r '.from')
  openclaw system event --text "📬 새 메일: $subj (from: $from)" --mode now
done

메일 답장

# 1. 원본 읽기
nmail read 42
# 2. 답장 작성 (from 주소로 send)
nmail send --to <original-from> --subject "Re: <original-subject>" --body "답장 내용"

Notes

• 출력은 기본 JSON. --pretty는 사람에게 보여줄 때만.
• 한글 제목/본문 자동 인코딩 (EUC-KR ↔ UTF-8)
• 앱 비밀번호는 ~/.nmail/config.yaml에 저장됨 (로컬 전용)
• 에러도 JSON: {"error": "message"}