Surface Cli

Use the Surface mail CLI to read and act on Gmail and Outlook mail through one JSON-first contract. Prefer this skill when you need Outlook access for school...

This skill appears to do what it says: it drives the 'surface' CLI to access Gmail/Outlook and stores state in ~/.surface-cli. Before installing or granting the agent autonomous access: 1) Inspect the npm package and source (the SKILL points to a GitHub repo) — check package.json scripts and recent commits; npm install can run arbitrary code. 2) Manually run and test 'surface' commands yourself (account add, auth login, fetch-unread) to confirm behavior before allowing an agent to run them. 3) Be cautious about enabling summarization/backends: the SKILL warns that enabling an external summarizer may send email content to a third-party model provider — only enable with explicit user consent. 4) Verify the CLI’s storage location (~/.surface-cli) and review stored tokens/credentials; treat those as sensitive. 5) If you need stronger assurance, request the exact npm tarball SHA or a signed release, or run the install in an isolated environment first. Note: metadata shows a minor version mismatch between the manifest (0.3.2) and the registry metadata (0.3.5); confirm you are installing the intended version.

Type: OpenClaw Skill Name: surface-cli Version: 0.3.5 The skill provides a legitimate interface for the 'surface-cli' tool to manage Gmail and Outlook accounts. The SKILL.md file includes comprehensive safety guidelines, explicitly instructing the agent to respect local write-safety policies, obtain user consent before enabling privacy-sensitive summarization features, and use draft modes for testing. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.