Send, receive, and manage emails via IMAP/POP3 and SMTP for multiple accounts supporting text, HTML, attachments, folders, and read status.

This skill appears to do what it says: send and receive email via SMTP/IMAP using credentials stored in config.yaml. Before installing, consider the following: - Protect config.yaml: it contains account usernames and plaintext passwords. Store it securely, restrict filesystem permissions, or use application-specific passwords rather than personal account passwords. - Understand data flow: getMessage returns message body text (and could be extended to return attachments). If your agent/LLM invokes the handlers, email contents will be visible to that agent. Do not load personal/private inboxes unless you trust the host and agent. - Rate limiting / abuse: SKILL.md mentions send limits, but the code does not implement rate limiting. Ensure your host enforces sending limits and monitors for abuse to avoid accidental spamming. - Dependency review: the package uses common npm libraries (imapflow, nodemailer). If your environment enforces supply-chain policies, vet those packages and the lockfile source mirrors. - Operational: the skill will throw an error if config.yaml is missing; follow the SKILL.md instructions to populate config.yaml on the host side. If you want stronger safety, use robot/service accounts or app-specific passwords, keep the config in a secrets manager and inject at runtime, and confirm which components (LLM, human UI, logs) will receive handler responses containing email bodies.

Type: OpenClaw Skill Name: generic-mail-client Version: 0.1.0 The skill is a standard email client implementation providing SMTP and IMAP functionality using well-known libraries (nodemailer and imapflow). The code logic in 'src/mailClient.ts' and 'src/index.ts' aligns with the stated purpose of sending, listing, and retrieving emails based on a local configuration file. It follows security best practices by keeping credentials within the host configuration and only exposing email metadata or specific content to the AI agent upon request, with no evidence of hidden data exfiltration, unauthorized network calls, or malicious instructions.