Qqmail 1.0.0

Manage QQ Mail (QQ邮箱) via IMAP/SMTP. Use when the user wants to read, send, search, or manage emails from their QQ mailbox. Supports reading inbox, sending e...

Security Scan

The skill appears to implement a legitimate QQ Mail IMAP/SMTP client, but there are notable inconsistencies in metadata and declared requirements that you should resolve before trusting it with credentials.

Purpose & Capability

The code and SKILL.md implement an IMAP/SMTP client for QQ Mail, which matches the name/description. However the package metadata/manifest is inconsistent: the skill runtime expects both QQMAIL_USER and QQMAIL_AUTH_CODE environment variables, but the registry metadata lists no required env vars and only declares QQMAIL_AUTH_CODE as primaryEnv. Also the _meta.json ownerId differs from the registry metadata owner ID, which is an ownership/packaging inconsistency that warrants verification.

Instruction Scope

SKILL.md tells the agent to run the included Python script which only contacts QQ IMAP/SMTP servers and reads/writes emails and optional attachment files. That scope is appropriate. But the instructions and script read QQMAIL_USER and QQMAIL_AUTH_CODE from the environment while the skill metadata does not declare QQMAIL_USER — the agent may not provide that variable automatically. There are no instructions to read arbitrary system files or send data to unexpected endpoints.

Install Mechanism

No install spec is provided and the skill is instruction-only with a bundled Python script. It requires python3 to be present; nothing is downloaded or installed automatically. This is the lowest-risk install pattern.

Credentials

The primary credential QQMAIL_AUTH_CODE is appropriate for an email client. However QQMAIL_USER is also required at runtime but not declared in the registry's required env vars. The mismatch can lead to runtime errors or accidental omission of the email address. The skill requests an authorization code (sensitive credential) — that is expected, but you should verify where and how you provide it before installing.

Persistence & Privilege

The skill is not forced-always enabled (always:false) and does not request elevated persistence or modify other skills. It can be invoked autonomously (platform default) but that is expected for skills and not a special privilege here.

What to consider before installing

This skill's code appears to be a normal QQ Mail IMAP/SMTP client, but there are metadata inconsistencies you should resolve before installing or providing credentials. Actions to consider: - Verify provenance: confirm the publisher/owner matches a trusted source (ownerId mismatch in _meta.json vs registry metadata is suspicious). - Inspect the full script locally (it is bundled) and ensure it only connects to imap.qq.com/smtp.qq.com and doesn't exfiltrate data elsewhere. - Provide credentials manually in a safe environment: set QQMAIL_USER and QQMAIL_AUTH_CODE yourself and test in a sandboxed account first. The SKILL.md and script require QQMAIL_USER even though the registry metadata omitted it. - If you rely on automated installation or credential injection, update the skill metadata to declare QQMAIL_USER to avoid operator error. - If you cannot verify the author or provenance, avoid supplying your real QQ authorization code; prefer a throwaway/test mailbox for initial testing.

QQ Mail Manager

Manage QQ邮箱 via standard IMAP/SMTP protocols using Python scripts.

Prerequisites

The user must enable IMAP/SMTP in QQ Mail settings and obtain an authorization code (授权码):

1. Log in to mail.qq.com → Settings (设置) → Account (账户)
2. Enable IMAP/SMTP service
3. Generate an authorization code (授权码) — this is NOT the QQ password

Configuration

The skill reads credentials from environment variables:

• QQMAIL_USER — QQ email address (e.g. [e-mail])
• QQMAIL_AUTH_CODE — Authorization code from QQ Mail settings (授权码)

Available Operations

Read recent emails

python3 {baseDir}/scripts/qqmail.py inbox --limit 10

Shows: sender, subject, date, and a text preview of each email.

Read a specific email by index

python3 {baseDir}/scripts/qqmail.py read --index 1

Shows the full email content (text body).

Send an email

python3 {baseDir}/scripts/qqmail.py send --to "[e-mail]" --subject "Hello" --body "Email content here"

Send with attachment

python3 {baseDir}/scripts/qqmail.py send --to "[e-mail]" --subject "Report" --body "See attached" --attachment "/path/to/file.pdf"

Search emails

python3 {baseDir}/scripts/qqmail.py search --subject "keyword"
python3 {baseDir}/scripts/qqmail.py search --from "[e-mail]"
python3 {baseDir}/scripts/qqmail.py search --since "2026-01-01"
python3 {baseDir}/scripts/qqmail.py search --subject "meeting" --since "2026-02-01" --limit 5

List mail folders

python3 {baseDir}/scripts/qqmail.py folders

Read from a specific folder

python3 {baseDir}/scripts/qqmail.py inbox --folder "Sent Messages" --limit 5

Error Handling

• If authentication fails: verify QQMAIL_USER and QQMAIL_AUTH_CODE are set correctly.
• If IMAP is not enabled: guide the user to enable it in QQ Mail settings.
• Connection errors may indicate network issues or proxy requirements.

Notes

• QQ Mail IMAP server: imap.qq.com:993 (SSL)
• QQ Mail SMTP server: smtp.qq.com:465 (SSL)
• All scripts use Python 3 standard library only (no pip install needed).
• Email content is decoded with charset detection for proper Chinese display.