batch-send-mail

This skill is internally coherent for sending bulk personalized email, but before installing, consider the following: - Stored credentials: the script saves SMTP credentials in plaintext to config/config.ini inside the skill folder. If you run this in a shared or cloud environment, those credentials may be accessible to others or other skills. Consider avoiding persistent storage, using per-run CLI flags, or storing credentials in a secure secret manager. - Use least-privilege credentials: create and use app-specific or limited-scope SMTP credentials (e.g., app passwords), not your primary account password. Rotate credentials after testing. - Logs and previews: dry-run prints full email bodies and addresses to stdout — avoid running on sensitive data in environments where logs are captured. - Autonomous invocation: the agent can invoke this skill autonomously by default. If you don’t want the agent to be able to send emails without explicit approval, disable autonomous use of the skill or review the agent's invocation policies. - Permissions and cleanup: check where config/config.ini is written (SCRIPT_DIR/config/config.ini), restrict file permissions, and delete the file after use if you don’t want persistent credentials. - Test safely: first run with --dry-run and a small test CSV and non-sensitive credentials to confirm behavior. If you need advice on secure alternatives (secret managers, ephemeral credentials, or audit controls), provide your runtime environment and I can suggest concrete changes.