✓
Purpose & Capability
Name/description match the code: it implements sending via SMTP (nodemailer) and reading/updating via IMAP (imapflow). Declared capabilities (multi-account, attachments, read/unread, move) are implemented and the required libraries are appropriate.
ℹ
Instruction Scope
SKILL.md instructs you to copy config.example.yaml to config.yaml and 'inject' it. The runtime code reads config.yaml from disk and uses credentials to connect to mail servers. That is expected for a mail client, but note the skill will have access to full mailboxes (message fetch returns bodyText/source) and the config file contains plaintext credentials—ensure you trust the host placement and file permissions. The README's claim that credentials are 'not visible to the LLM' is implementation-dependent (the code does not intentionally return credentials, but errors or platform exposure could leak them).
!
Install Mechanism
There is no install spec even though the code depends on npm packages (imapflow, nodemailer, js-yaml). That mismatch means a platform or operator must ensure Node and those dependencies are present; otherwise the skill will fail. The included package-lock shows packages resolved from a third-party mirror (mirrors.tencentyun.com) rather than the default npm registry — not automatically malicious but worth verifying provenance before installing dependencies.
ℹ
Credentials
The skill requests no env vars and instead expects a local config.yaml containing mail account credentials (username/password). That is proportionate for the stated purpose, but plaintext credentials in a file increase risk of accidental disclosure. The code does not request unrelated credentials or config paths.
✓
Persistence & Privilege
Skill does not request always:true, does not modify other skills or system-wide settings, and only reads a local config.yaml for its own operation.
Scan Findings in Context
[external-mirror-in-package-lock] unexpected: package-lock.json contains resolved URLs pointing at mirrors.tencentyun.com. For a mail client this is not required by functionality; it affects supply-chain trust. Verify the origin or rebuild dependencies from a trusted registry before running.
[network-io-libraries] expected: Use of imapflow and nodemailer (network I/O libraries) is expected for IMAP/SMTP functionality.
Assessment
This skill is functionally coherent for accessing and sending mail, but review the following before installing: 1) You must provide config.yaml containing account usernames/passwords—store it securely (correct file ownership/permissions) and prefer app-specific or bot accounts, not personal credentials. 2) The package-lock references a non-default npm mirror; validate dependency provenance or run npm install from a trusted registry and/or rebuild from source. 3) Because the skill reads mailboxes and can return message bodies, consider running it in an isolated environment or with limited accounts to reduce blast radius. 4) Ensure the runtime has Node and the required packages available (there is no install spec). If you are uncomfortable with any of the above, do not install or run the skill until provenance and deployment details are clarified.
