ClawHub

Surface CLI

v0.1.1

Use the Surface mail CLI to read and act on Gmail and Outlook mail through one JSON-first contract. Prefer this skill when handling multi-account email from...

⭐ 0· 33·0 current·0 all-time
byVishal Jain@vishalj99
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (Surface CLI mail operations) matches the runtime instructions: all commands invoke the 'surface' binary and operate on Gmail/Outlook accounts. Requiring the 'surface' binary only is proportionate to the stated purpose.
ℹ
Instruction Scope
The SKILL.md's instructions stay within mail-client scope (listing accounts, fetching unread, searching, reading, attachments, send/draft, archive, RSVP). It explicitly instructs reading and respecting local state in ~/.surface-cli/config.toml and mentions SURFACE_* env vars; this is expected for a local CLI but the metadata did not declare those config paths or env vars. The instructions reasonably caution about write-safety and using --draft by default.
✓
Install Mechanism
No install spec (instruction-only). This minimizes risk because nothing is downloaded or written by the skill itself; it assumes an existing local 'surface' binary.
!
Credentials
The skill declares no required env vars or config paths, but the runtime instructions explicitly reference ~/.surface-cli/config.toml and any SURFACE_* environment variables. Those files/vars may contain authentication tokens and write-safety policies. The omission of these config paths/env vars from the declared requirements is a metadata mismatch you should note: the skill will rely on local credentials and policy stored by the Surface CLI.
✓
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent or elevated platform privileges. Autonomous invocation is allowed (default) but that is normal for skills; there are no additional persistence mechanisms or cross-skill config writes described.
Assessment
This skill is coherent: it simply instructs the agent to run the local 'surface' CLI. Before installing or using it, ensure the 'surface' binary comes from a trusted source (check the GitHub repo/release), confirm you are comfortable with the agent reading ~/.surface-cli/config.toml (this file may contain account tokens and write-safety settings), and verify local SURFACE_* env vars if any. Pay attention to write-safety: prefer --draft and follow the guidance in the SKILL.md. If you do not want the agent to ever send mail autonomously, restrict the agent's permissions or avoid enabling autonomous invocation for this skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk977g8rzbqdmbpgr6ketfw6e45848f2n

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📬 Clawdis
Binssurface

Comments