work-mail-notifier

QQ邮箱工作邮件监控与标注已读。当用户提到工作邮件通知、邮件日报、新邮件提醒、或需要标注邮件已读时触发。

This skill's code does what it claims (monitor QQ mail via the himalaya CLI and allow marking messages read) but the package metadata omits important runtime requirements. Before installing or running: 1) Confirm you have the himalaya CLI installed and properly configured for your QQ account (the scripts call 'himalaya' and will use its local credentials). 2) Ensure the python dependency html2text is available or install it. 3) Note the scripts use hard-coded absolute paths (/home/ubuntu/.openclaw/...); update them if your agent runs under a different user or run in a sandbox to avoid accidental access to other users' files. 4) Inspect ~/.openclaw/workspace/data/last_notification.json and anchor files after first run — they store message metadata (subject, sender, ids) which is sensitive. 5) If you need stronger guarantees, run the scripts in an isolated environment or test with a non-production mailbox first. The main risks are missing dependency declarations, implicit access to mailbox credentials via the system himalaya configuration, and hard-coded paths — these are implementation issues rather than evidence of malicious behavior.

Type: OpenClaw Skill Name: work-mail-notifier Version: 2.0.0 The skill bundle is a legitimate tool for monitoring and managing QQ email folders using the 'himalaya' CLI. The scripts (work_mail_notifier.py, mark_read.py, and show_body.py) implement email fetching, classification, and status updates as described in SKILL.md. The code uses safe subprocess execution, follows a clear logic for state management via local JSON files, and contains no evidence of data exfiltration, malicious execution, or prompt injection.