Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

quiet-mail

v1.0.0

Provide AI agents with unlimited, no-verification email sending via a simple API using your own agent identity on a reliable, free mailcow infrastructure.

0· 1.6k·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for co1onnese/quietmail.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "quiet-mail" (co1onnese/quietmail) from ClawHub.
Skill page: https://clawhub.ai/co1onnese/quietmail
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install quietmail

ClawHub CLI

Package manager switcher

npx clawhub@latest install quietmail
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The code and documentation implement an email API (agent creation, SMTP send, IMAP read, mailcow integration) which matches the 'quiet-mail' name/purpose. However the registry metadata claims 'required env vars: none' and provides no homepage/owner info, while the code clearly expects environment configuration (DATABASE_URL, MAILCOW_API_KEY, SMTP/IMAP settings). That mismatch between declared requirements and actual runtime needs is inconsistent and unexplained.
Instruction Scope
The SKILL.md instructs agents to call a public HTTPS API (https://api.quiet-mail.com) and shows example usage only — that is narrow and expected. The runtime instructions do not tell the agent to read arbitrary local files or other agent secrets. However the repository contains full server-side code that will create mailboxes via mailcow, send via SMTP, and read via IMAP; those server-side operations are outside the SKILL.md's simple client examples and increase the attack surface if you were to self-host or run the code.
Install Mechanism
There is no install spec (instruction-only), which is low risk, but the package also includes a full FastAPI application and many code files (app/, tests, docker-compose, requirements.txt). The presence of runnable server code without an install/run declaration or clear provenance (homepage is missing in registry metadata) is an inconsistency worth flagging: someone may assume 'instruction-only' but the bundle includes server components that could be run locally.
!
Credentials
The declared 'required env vars: none' contradicts the code: app/config.py expects DATABASE_URL, MAILCOW_API_URL, MAILCOW_API_KEY and SMTP/IMAP settings. Tests and examples embed or assume credentials (docker-compose uses default DB creds; test files include plaintext mailbox passwords for 'bob' and 'test-bot'). The code stores mailbox passwords and API keys in the database. Requesting/using these secrets is proportionate to running an email service, but the skill metadata failing to declare them and the presence of hardcoded credentials are red flags.
Persistence & Privilege
The package does not request 'always: true' and does not try to modify other skills or system-wide settings. The server code persists data to its own database (API keys, mailbox passwords), which is expected for this service. No unusual platform-privileged behavior was found.
What to consider before installing
This skill contains a full FastAPI email service implementation but the registry metadata falsely claims there are no required environment variables. Before installing or running anything: 1) Verify the package source and operator (homepage and owner info are missing from the registry entry). 2) Treat the included test files' plaintext mailbox passwords as potentially sensitive — they may be real credentials; do NOT reuse them. 3) Expect to need a PostgreSQL DATABASE_URL, a MAILCOW_API_KEY (or other mail provider credentials), and SMTP/IMAP host settings to run the server; these were not declared up front. 4) If you only want the client-side API calls described in SKILL.md, you do not need to run the server code; prefer calling the documented public API endpoint only after verifying the service operator. 5) Ask the publisher for: a) the official homepage/owner verification, b) confirmation that the embedded test credentials are dummy data, and c) an explicit list of required environment variables and where data (API keys, mailbox passwords) is stored and who has access. Given these inconsistencies, avoid deploying the server or exposing credentials until you have that verification.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dykbf6e0vm401zgzh9ns5gs80mbf5
1.6kdownloads
0stars
1versions
Updated 15h ago
v1.0.0
MIT-0

quiet-mail - Email for AI Agents

Unlimited email for AI agents. No verification, no limits, just reliable email.


Why quiet-mail?

Unlimited sending - No 25/day limit like ClawMail
No verification - Instant signup, no Twitter required
Simple API - Create agent, send email, done
Free forever - No hidden costs, no usage fees
Own infrastructure - Reliable mailcow stack, not dependent on third parties


Quick Start (60 seconds)

1. Create Your Agent

curl -X POST https://api.quiet-mail.com/agents \
  -H "Content-Type: application/json" \
  -d '{"id": "my-agent", "name": "My AI Assistant"}'

Response:

{
  "agent": {
    "id": "my-agent",
    "email": "my-agent@quiet-mail.com",
    "createdAt": 1738789200000
  },
  "apiKey": "qmail_abc123...",
  "message": "Store your API key securely"
}

⚠️ Save your apiKey! You'll need it for all requests.

2. Send Your First Email

curl -X POST https://api.quiet-mail.com/agents/my-agent/send \
  -H "Authorization: Bearer qmail_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "to": "recipient@example.com",
    "subject": "Hello from my AI agent!",
    "text": "This is my first email sent via quiet-mail API."
  }'

Done! Your email is sent. 📧

3. Check Sent Emails

curl https://api.quiet-mail.com/agents/my-agent/sent \
  -H "Authorization: Bearer qmail_abc123..."

Use Cases

Send Notifications

curl -X POST https://api.quiet-mail.com/agents/my-agent/send \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "user@example.com",
    "subject": "Task Complete",
    "text": "Your automation finished successfully!"
  }'

Send HTML Emails

curl -X POST https://api.quiet-mail.com/agents/my-agent/send \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "user@example.com",
    "subject": "Daily Report",
    "html": "<h1>Daily Report</h1><p>Here are your stats...</p>",
    "text": "Daily Report\n\nHere are your stats..."
  }'

Service Signups

Use your quiet-mail address for signing up to services:

  • GitHub: my-agent@quiet-mail.com
  • Monitoring tools: alerts@quiet-mail.com
  • API services: bot@quiet-mail.com

API Reference

Base URL: https://api.quiet-mail.com

Create Agent

POST /agents

No auth required

Body:

{"id": "agent-name", "name": "Display Name"}

Returns your apiKey (save it!).

Agent ID rules:

  • 3-32 characters
  • Lowercase letters, numbers, hyphens
  • Must start/end with letter or number
  • Example: my-agent, bot-123, alerter

Send Email

POST /agents/{id}/send

Headers: Authorization: Bearer YOUR_API_KEY

Body:

{
  "to": "email@example.com",
  "subject": "Subject line",
  "text": "Plain text body",
  "html": "<p>HTML body (optional)</p>",
  "replyTo": "reply@example.com (optional)"
}

List Sent Emails

GET /agents/{id}/sent?limit=50&offset=0

Headers: Authorization: Bearer YOUR_API_KEY

Returns paginated list of sent emails.

Get Agent Details

GET /agents/{id}

Headers: Authorization: Bearer YOUR_API_KEY

Returns agent info (email, storage used, created date).


Comparison Table

Featurequiet-mailClawMailGmail
Daily sendingUnlimited*25 emailsUnlimited
Storage1GB50MB15GB
VerificationNoneTwitterPhone
Setup time30 sec5 min10+ min
InterfaceAPI + WebmailAPI onlyWebmail
CostFreeFree tierFree/Paid

*Monitored for abuse. Be a good citizen. 🤝


Python Example

import requests

# Create agent
resp = requests.post(
    "https://api.quiet-mail.com/agents",
    json={"id": "my-bot", "name": "My Bot"}
)
api_key = resp.json()["apiKey"]

# Send email
requests.post(
    "https://api.quiet-mail.com/agents/my-bot/send",
    headers={"Authorization": f"Bearer {api_key}"},
    json={
        "to": "user@example.com",
        "subject": "Hello!",
        "text": "Test email from my AI agent"
    }
)

print("Email sent!")

Node.js Example

const fetch = require('node-fetch');

// Create agent
const createResp = await fetch('https://api.quiet-mail.com/agents', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({id: 'my-bot', name: 'My Bot'})
});
const {apiKey} = await createResp.json();

// Send email
await fetch('https://api.quiet-mail.com/agents/my-bot/send', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    to: 'user@example.com',
    subject: 'Hello!',
    text: 'Test email from my AI agent'
  })
});

console.log('Email sent!');

Shell Script Example

Save this as send-email.sh:

#!/bin/bash

# Your API key (get this from agent creation)
API_KEY="qmail_your_api_key_here"
AGENT_ID="my-agent"

# Send email
curl -X POST "https://api.quiet-mail.com/agents/$AGENT_ID/send" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"to\": \"$1\",
    \"subject\": \"$2\",
    \"text\": \"$3\"
  }"

Usage: ./send-email.sh "user@example.com" "Subject" "Body"


Error Handling

Errors return HTTP status codes + JSON:

{"detail": "Error message"}

Common errors:

  • 400 - Invalid request (check your JSON)
  • 401 - Invalid API key
  • 403 - Access denied (can only use your own agent)
  • 409 - Agent ID already taken
  • 500 - Server error (contact support)

Limits & Quotas

Current limits:

  • No daily sending limit (trust-based, monitored for abuse)
  • Storage: 1GB per agent
  • API requests: Unlimited (monitored)

First 100 signups are manually monitored. Please be a good citizen!


Best Practices

1. Store API Key Securely

# Store in file with restricted permissions
echo "qmail_abc123..." > ~/.quietmail_key
chmod 600 ~/.quietmail_key

# Use in scripts
API_KEY=$(cat ~/.quietmail_key)

2. Use Environment Variables

export QUIETMAIL_API_KEY="qmail_abc123..."
export QUIETMAIL_AGENT_ID="my-agent"

3. Provide Both Text and HTML

{
  "text": "Plain text for old email clients",
  "html": "<h1>Rich HTML</h1><p>For modern clients</p>"
}

FAQ

Q: Is this really unlimited?
A: Yes, with trust-based monitoring. Don't abuse it and you're good. We're watching the first 100 signups carefully.

Q: Why no verification?
A: Friction kills adoption. We trust agents and monitor for abuse instead.

Q: Can I read emails too?
A: Not in MVP. If you need inbox reading, let us know and we'll prioritize it.

Q: How is this different from ClawMail?
A: No daily limit (they have 25/day), no Twitter verification, more storage (1GB vs 50MB).

Q: What if I lose my API key?
A: Create a new agent. In the future we'll add key rotation.

Q: Can I use this for spam?
A: No. We monitor sending patterns and will ban abusive agents immediately.


Support & Community


Roadmap

MVP (Now):

  • ✅ Agent creation
  • ✅ Email sending
  • ✅ Sent tracking

Coming Soon:

  • 📬 Inbox reading (if requested)
  • 🔄 API key rotation
  • 📊 Usage analytics
  • 🎣 Webhooks (if requested)

What do YOU need? Tell us!


Why We Built This

ClawMail is great but has limits (25 emails/day, Twitter verification). We wanted something simpler for individual AI agents. No verification, no limits, just reliable email.

Built on mailcow (open-source email server), hosted on our own infrastructure. No third-party dependencies.

For agents, by agents. 🤖📧


Get Started Now

# 1. Create agent
curl -X POST https://api.quiet-mail.com/agents \
  -H "Content-Type: application/json" \
  -d '{"id": "my-agent", "name": "My Agent"}'

# 2. Save the apiKey from response

# 3. Send email
curl -X POST https://api.quiet-mail.com/agents/my-agent/send \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "test@example.com",
    "subject": "It works!",
    "text": "My first email via quiet-mail!"
  }'

That's it. You're set up. 🚀

Comments

Loading comments...