Post

Manage IMAP email with the Post CLI and local daemon. Use when reading, searching, fetching, drafting, replying, reply-all, moving, archiving, trashing, expo...

Security Scan

The skill is internally consistent with its stated purpose (a macOS Post CLI + daemon integration installed via Homebrew); nothing requested or instructed is disproportionate to managing IMAP mail, though you should be careful with scoped API keys and hook scripts which can execute arbitrary commands and receive email data.

Purpose & Capability

Name/description, required binaries (post, postd), and the Homebrew install formula align with a local macOS mail CLI/daemon. Required items are proportional to the stated functionality.

Instruction Scope

Runtime instructions stay on-topic (search, fetch, draft, reply, attachments, daemon setup). They explicitly describe optional config files (~/.post.json), scoped API-key usage, and daemon hook commands. Important: hook commands receive environment variables and a JSON payload and can run arbitrary scripts/commands — this is expected for hook functionality but is the primary area where data (email contents, metadata, and tokens if misconfigured) could be exposed or acted on.

Install Mechanism

Install uses a Homebrew formula from cocoanetics/tap, a standard macOS package mechanism. This is an expected and low-risk install channel for a macOS-only CLI/daemon.

Credentials

The skill does not require environment variables to function, but the documentation instructs using scoped POST_API_KEY tokens and optionally storing them in an agent workspace .env file. Requesting and using API tokens is appropriate, but these tokens grant mailbox access and must be scoped and protected (chmod 600, avoid global shells).

Persistence & Privilege

always is false and the skill does not request system-wide privileges beyond optional LaunchAgent instructions to auto-start the daemon. The provided LaunchAgent and daemon controls are appropriate for a background mail daemon on macOS; no evidence the skill modifies other skills or system-wide agent configs beyond standard daemon install steps.

Assessment

This skill appears to do exactly what it says: manage IMAP mail via a local CLI and daemon installed from Homebrew. The main risks are operational: 1) Scoped POST_API_KEY tokens grant mailbox access — only give agents the narrowest token they need, store tokens in a restricted workspace (.env with chmod 600) and rotate/delete tokens when unused. 2) If you configure a daemon hook (command), that script will receive email metadata and a JSON payload and can run arbitrary commands on your machine; only use trusted hook scripts and avoid placing hook scripts in paths writable by untrusted agents. 3) Auto-starting postd via LaunchAgent is normal for a daemon but gives continuous background access to mail; ensure you trust the software and the Homebrew tap. If you want added assurance, review the Homebrew formula source and the upstream GitHub repo releases before installing and restrict agent permissions to scoped tokens rather than full-access credentials.

Use the post CLI for email tasks and postd for the background daemon.

Read First

• Read SETUP.md for first-time install, keychain credentials, daemon setup, and scoped API keys.
• Read references/common-tasks.md for concrete workflows and reply recipes.

Core Rules

• Treat UIDs as mailbox-scoped, not globally unique. If a message is not in INBOX, pass --reply-mailbox <mailbox> when replying.
• Prefer --json when the result will be parsed or reused in a later step.
• Prefer scoped API keys for agents. Use --token <token> for one-off commands or set POST_API_KEY only in that agent’s environment.
• Use post draft --replying-to <uid> for threaded replies. This auto-derives from, to, and subject, and sets In-Reply-To / References.
• Omit --body to create a Mail-style reply draft with quoted original content ready for inline editing.
• Use --reply-all only when you really want all original recipients copied.

Fast Command Map

Inspect accounts and folders

post servers
post folders --server <server>
post status --server <server> --mailbox INBOX

Find mail

post list --server <server> --mailbox INBOX --limit 20
post search --server <server> --from "[e-mail]" --since 2026-03-01
post fetch <uid> --server <server> --mailbox INBOX
post fetch <uid> --server <server> --mailbox INBOX --json

Draft and reply

# New draft
post draft --server <server> --from [e-mail] --to [e-mail] \
  --subject "Hello" --body reply.md

# Threaded reply with body
post draft --server <server> --replying-to <uid> --body reply.md

# Threaded reply, reply-all
post draft --server <server> --replying-to <uid> --reply-all --body reply.md

# Threaded reply for inline editing in Mail.app
post draft --server <server> --replying-to <uid>

# Reply to a message outside INBOX
post draft --server <server> --replying-to <uid> --reply-mailbox Archive --body reply.md

Attachments and exports

post attachment <uid> --server <server> --mailbox INBOX --output /tmp/mail
post pdf <uid> --server <server> --mailbox INBOX --output /tmp/
post eml <uid> --server <server> --mailbox INBOX --output /tmp/

Organize mail

post move <uids> Archive --server <server> --mailbox INBOX
post archive <uids> --server <server> --mailbox INBOX
post trash <uids> --server <server> --mailbox INBOX
post junk <uids> --server <server> --mailbox INBOX

Reply Workflow Guidance

For real replies, prefer one of these two modes:

1. Compose in Markdown first

   • Fetch the original message
   • Write a .md file with your reply
   • Use post draft --replying-to <uid> --body reply.md

2. Create a native Mail-style draft

   • Use post draft --replying-to <uid>
   • Open and finish it in Mail.app

For multi-question emails, fetch the message first, identify each question, and write an interleaved Markdown reply using blockquotes. See references/common-tasks.md for a full example.

Security / Agent Isolation

Use per-agent API keys instead of sharing a full-access environment:

post api-key create --servers work
post api-key create --servers personal

Then either:

post servers --token <token>

or set only that agent’s environment:

export POST_API_KEY=<token>

Details and setup examples live in SETUP.md.