← Back to Skills Marketplace
657
Downloads
1
Stars
2
Active Installs
3
Versions
Install in OpenClaw
/install zoho-cli
Description
Read, search, send, and manage Zoho Mail from the terminal. JSON output for scripting and agents. No third-party service required.
Usage Guidance
This skill appears to be what it says: a wrapper that calls the 'zoho' CLI and uses local OAuth tokens. Before installing or invoking: 1) Verify the upstream repo (https://github.com/robsannaa/zoho-cli) and Homebrew tap (robsannaa/tap) — installing via pipx/uv/homebrew will run code from that repo, so review it if you don't trust the author. 2) Understand OAuth sensitivity — the CLI stores client_id/client_secret and tokens locally (config.json and OS keyring); protect those files and avoid putting ZOHO_TOKEN_PASSWORD or client secrets into shared CI without encryption. 3) Note the metadata mismatch: SKILL.md sets user-invocable: false while registry metadata allows invocation; confirm whether you want the agent to call the CLI autonomously (an agent cannot complete the interactive 'zoho login' browser flow without manual steps). 4) If you deploy this in shared environments, restrict access to the config path and keyring entries. If you want me to, I can fetch and summarize the GitHub repo contents (setup files, install scripts) so you can inspect what would be installed.
Capability Analysis
Type: OpenClaw Skill
Name: zoho-cli
Version: 0.1.4
The skill is classified as suspicious due to its inherent handling of highly sensitive data (OAuth client_id/client_secret, access/refresh tokens) which are stored locally in configuration files and the OS keyring, as explicitly disclosed in SKILL.md. While this storage is local and transparently communicated, it presents a significant risk if the system or agent is compromised. Additionally, the skill provides file write capabilities via `zoho mail download-attachment` and email sending capabilities via `zoho mail send`, which, if combined with a malicious prompt to the agent, could be exploited for unauthorized file manipulation or communication. There is no direct evidence of intentional malicious behavior or prompt injection within the skill's instructions, but the capabilities themselves carry high risk.
Capability Assessment
Purpose & Capability
The name/description (Zoho Mail CLI) match the runtime instructions: the skill expects the 'zoho' CLI, performs mail list/search/get/download/send operations, and requires OAuth credentials for Zoho. No unrelated service credentials or binaries are requested.
Instruction Scope
SKILL.md stays within the mail-CLI scope (running 'zoho' commands, checking config, and using OS keyring). It documents one-time interactive OAuth login ('zoho login' opens a browser), local config and keyring storage, and optional env vars. Note: the SKILL.md header sets 'user-invocable: false' while registry metadata indicates the skill is user-invocable/autonomously callable — an inconsistency to resolve. Also, interactive browser login cannot be completed by an autonomous agent without extra steps, which limits autonomous use until login is done.
Install Mechanism
This is instruction-only (no platform install spec). SKILL.md shows typical user install paths (Homebrew, uv, pipx from a GitHub repo). Because the platform will not itself download/extract code, the risk is low from the skill bundle; however installing the CLI from the referenced GitHub repo will pull code from that repo — users should vet the upstream source before running install commands.
Credentials
The registry lists no required env vars, while SKILL.md documents optional envs (ZOHO_ACCOUNT, ZOHO_CONFIG, ZOHO_TOKEN_PASSWORD) and clarifies that OAuth client_id/client_secret and access/refresh tokens are sensitive and stored locally. These credentials are proportionate to the stated purpose, but the discrepancy between registry metadata and SKILL.md (no primary credential declared vs. SKILL.md describing OAuth tokens) should be noted.
Persistence & Privilege
The skill does not request 'always: true' or other elevated persistent privileges, nor does it claim to modify other skills or system-wide configs. It operates by invoking an external CLI and using local config/keyring, which is expected for this function.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install zoho-cli - After installation, invoke the skill by name or use
/zoho-cli - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.4
zoho-cli 0.1.4 changelog
- Clarified requirements in skill description and readme: emphasized need for 'zoho' binary, OAuth setup, and local credential storage.
- Added note on credential storage to further highlight local config and OS keyring usage.
- No new features or command changes; updated documentation and descriptions only.
v0.1.3
**Added compatibility and credential storage information for transparency and user security awareness.**
- Added a "compatibility" section outlining CLI/tool requirements and sensitive credential handling.
- Documented where OAuth client/secret and tokens are stored and why users should protect them.
- No changes to commands or functionality; documentation and metadata only.
v0.1.2
## zoho-cli 0.1.2 changelog
- Updated SKILL.md with detailed install, usage, and command documentation
- Added clearer instructions for prerequisites and authentication flows
- Enhanced documentation of CLI output formats and error handling
- Clarified usage of global flags and environment variables
- Documented all major commands and typical scripting patterns for automation
- Improved error response examples and code explanations
Metadata
Frequently Asked Questions
What is Zoho Mail CLI?
Read, search, send, and manage Zoho Mail from the terminal. JSON output for scripting and agents. No third-party service required. It is an AI Agent Skill for Claude Code / OpenClaw, with 657 downloads so far.
How do I install Zoho Mail CLI?
Run "/install zoho-cli" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Zoho Mail CLI free?
Yes, Zoho Mail CLI is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Zoho Mail CLI support?
Zoho Mail CLI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Zoho Mail CLI?
It is built and maintained by robsanna (@robsannaa); the current version is v0.1.4.
More Skills