Zoho Mail

Full read/write Zoho Mail access for OpenClaw agents

Security Scan

The skill's code, runtime instructions, and required secrets are consistent with a Zoho Mail client that needs OAuth credentials and a local encryption key to store tokens; nothing obviously unrelated or malicious is present.

Purpose & Capability

Name/description (Zoho Mail full read/write) matches the shipped code and SKILL.md. The required env vars (ZOHO_MAIL_TOKEN_KEY, ZOHO_CLIENT_ID, ZOHO_CLIENT_SECRET) and required binary (zoho-mail) are exactly what an OAuth-backed mail CLI needs.

Instruction Scope

SKILL.md runtime instructions and the CLI commands (auth, mail, folders, config) align with the code. The interactive OAuth flow, local token encryption, config directory, and file paths referenced are limited to the skill's mailbox purpose and do not request unrelated system data or external endpoints beyond Zoho/GitHub.

Install Mechanism

No formal registry install spec was declared, but SKILL.md provides curl/download instructions that fetch releases from the project's GitHub repository (no URL shorteners or personal IPs). This is a common pattern; users should verify the release source and checksums before running the install commands.

Credentials

Only three environment variables are required and they are used for their expected purposes: client ID/secret for OAuth and a token encryption passphrase. The code does not read other secrets or unrelated env vars.

Persistence & Privilege

The skill stores an encrypted token under ~/.openclaw/credentials/zoho-mail/token.enc (or ZOHO_MAIL_CONFIG_DIR) and persists refreshed tokens. It does not modify other skills or system-wide configurations. always is false and normal agent autonomous invocation is allowed by default.

Assessment

This skill appears coherent with its stated purpose, but before installing: 1) remember it has full read/write access to the linked Zoho mailbox — treat the required client credentials and ZOHO_MAIL_TOKEN_KEY as highly sensitive; 2) verify the GitHub release you download (check tags and the provided checksums) to avoid installing a tampered binary; 3) store the three secrets in a secure secrets manager and ensure the instance's .env/SSM parameters are protected from other users/processes; 4) the operator must perform an interactive OAuth login (pasting the full redirect URL) — ensure that process is done securely; 5) if you need principle-of-least-privilege, consider creating a Zoho client with minimal scopes or a dedicated mailbox account rather than using a high-privilege personal account.

Zoho Mail Skill

Full read/write access to a Zoho Mail account (EU data centre).

Installation

Download the latest release binary for linux/arm64 and install to ~/.openclaw/bin/:

TAG=$(curl -fsSL "https://api.github.com/repos/PanthroCorp-Limited/openclaw-skills/releases" \
  | grep -o '"tag_name":"zoho-mail/v[^"]*"' | head -1 | cut -d'"' -f4)
VERSION=${TAG#zoho-mail/v}
curl -fsSL "https://github.com/PanthroCorp-Limited/openclaw-skills/releases/download/${TAG}/zoho-mail_${VERSION}_linux_arm64.tar.gz" \
  | tar -xz -C ~/.openclaw/bin/ zoho-mail
chmod +x ~/.openclaw/bin/zoho-mail

Important

OAuth tokens are encrypted at rest. The operator must run zoho-mail auth login once after deployment to complete the OAuth flow.

Check configuration

zoho-mail config show

Mail commands

List messages in a folder (default: INBOX):

zoho-mail mail list
zoho-mail mail list --folder INBOX --limit 20 --start 0

Read a message by ID:

zoho-mail mail read --id MESSAGE_ID

Send a new message:

zoho-mail mail send --to [e-mail] --subject "Hello" --body "Message body"
zoho-mail mail send --to [e-mail] --subject "Hello" --body "<p>HTML body</p>" --html
zoho-mail mail send --to [e-mail] --cc [e-mail] --subject "Hello" --body "Body"

Reply to a message:

zoho-mail mail reply --id MESSAGE_ID --body "Reply text"
zoho-mail mail reply --id MESSAGE_ID --body "<p>HTML reply</p>" --html

Search messages:

zoho-mail mail search --query "from:[e-mail]"
zoho-mail mail search --query "subject:invoice" --limit 20

Delete a message:

zoho-mail mail delete --id MESSAGE_ID --folder FOLDER_ID

Mark messages as read or unread:

zoho-mail mail mark --ids id1,id2,id3 --read
zoho-mail mail mark --ids id1 --unread

Folder commands

List all folders:

zoho-mail folders list

Authentication commands

Complete the OAuth flow (interactive, run by operator):

zoho-mail auth login

Check authentication status:

zoho-mail auth status

Delete the stored token:

zoho-mail auth revoke

Output format

All commands output JSON by default.

Setup (operator, one-time per instance)

1. Set the account email address:

   zoho-mail config set --email [e-mail]
   

2. Authenticate:

   zoho-mail auth login
   

   Visit the printed URL, authenticate, then paste the full redirect URL back into the terminal.