← 返回 Skills 市场

imap-smtp-email-chinese

Name: imap-smtp-email-chinese
Author: apple133junjiang-a11y

作者 apple133junjiang-a11y · GitHub ↗ · v1.1.0

cross-platform ⚠ suspicious

2145

总下载

当前安装

版本数

在 OpenClaw 中安装

/install imap-smtp-email-chinese

功能描述

Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Wor...

使用说明 (SKILL.md)

IMAP/SMTP Email Tool

Read, search, and manage email via IMAP protocol. Send email via SMTP. Supports Gmail, Outlook, 163.com, vip.163.com, 126.com, vip.126.com, 188.com, vip.188.com, and any standard IMAP/SMTP server.

Configuration

Create .env in the skill folder or set environment variables:

# IMAP Configuration (receiving email)
IMAP_HOST=imap.gmail.com          # Server hostname
IMAP_PORT=993                     # Server port
[email protected]
IMAP_PASS=your_password
IMAP_TLS=true                     # Use TLS/SSL connection
IMAP_REJECT_UNAUTHORIZED=true     # Set to false for self-signed certs
IMAP_MAILBOX=INBOX                # Default mailbox

# SMTP Configuration (sending email)
SMTP_HOST=smtp.gmail.com          # SMTP server hostname
SMTP_PORT=587                     # SMTP port (587 for STARTTLS, 465 for SSL)
SMTP_SECURE=false                 # true for SSL (465), false for STARTTLS (587)
[email protected]          # Your email address
SMTP_PASS=your_password           # Your password or app password
[email protected]          # Default sender email (optional)
SMTP_REJECT_UNAUTHORIZED=true     # Set to false for self-signed certs

Common Email Servers

Provider	IMAP Host	IMAP Port	SMTP Host	SMTP Port
163.com	imap.163.com	993	smtp.163.com	465
vip.163.com	imap.vip.163.com	993	smtp.vip.163.com	465
126.com	imap.126.com	993	smtp.126.com	465
vip.126.com	imap.vip.126.com	993	smtp.vip.126.com	465
188.com	imap.188.com	993	smtp.188.com	465
vip.188.com	imap.vip.188.com	993	smtp.vip.188.com	465
yeah.net	imap.yeah.net	993	smtp.yeah.net	465
Gmail	imap.gmail.com	993	smtp.gmail.com	587
Outlook	outlook.office365.com	993	smtp.office365.com	587
QQ Mail	imap.qq.com	993	smtp.qq.com	587

Important for 163.com:

Use authorization code (授权码), not account password
Enable IMAP/SMTP in web settings first

IMAP Commands (Receiving Email)

check

Check for new/unread emails.

node scripts/imap.js check [--limit 10] [--mailbox INBOX] [--recent 2h]

Options:

--limit \x3Cn>: Max results (default: 10)
--mailbox \x3Cname>: Mailbox to check (default: INBOX)
--recent \x3Ctime>: Only show emails from last X time (e.g., 30m, 2h, 7d)

fetch

Fetch full email content by UID.

node scripts/imap.js fetch \x3Cuid> [--mailbox INBOX]

download

Download all attachments from an email, or a specific attachment.

node scripts/imap.js download \x3Cuid> [--mailbox INBOX] [--dir \x3Cpath>] [--file \x3Cfilename>]

Options:

--mailbox \x3Cname>: Mailbox (default: INBOX)
--dir \x3Cpath>: Output directory (default: current directory)
--file \x3Cfilename>: Download only the specified attachment (default: download all)

search

Search emails with filters.

node scripts/imap.js search [options]

Options:
  --unseen           Only unread messages
  --seen             Only read messages
  --from \x3Cemail>     From address contains
  --subject \x3Ctext>   Subject contains
  --recent \x3Ctime>    From last X time (e.g., 30m, 2h, 7d)
  --since \x3Cdate>     After date (YYYY-MM-DD)
  --before \x3Cdate>    Before date (YYYY-MM-DD)
  --limit \x3Cn>        Max results (default: 20)
  --mailbox \x3Cname>   Mailbox to search (default: INBOX)

mark-read / mark-unread

Mark message(s) as read or unread.

node scripts/imap.js mark-read \x3Cuid> [uid2 uid3...]
node scripts/imap.js mark-unread \x3Cuid> [uid2 uid3...]

list-mailboxes

List all available mailboxes/folders.

node scripts/imap.js list-mailboxes

SMTP Commands (Sending Email)

send

Send email via SMTP.

node scripts/smtp.js send --to \x3Cemail> --subject \x3Ctext> [options]

Required:

--to \x3Cemail>: Recipient (comma-separated for multiple)
--subject \x3Ctext>: Email subject, or --subject-file \x3Cfile>

Optional:

--body \x3Ctext>: Plain text body
--html: Send body as HTML
--body-file \x3Cfile>: Read body from file
--html-file \x3Cfile>: Read HTML from file
--cc \x3Cemail>: CC recipients
--bcc \x3Cemail>: BCC recipients
--attach \x3Cfile>: Attachments (comma-separated)
--from \x3Cemail>: Override default sender

Examples:

# Simple text email
node scripts/smtp.js send --to [email protected] --subject "Hello" --body "World"

# HTML email
node scripts/smtp.js send --to [email protected] --subject "Newsletter" --html --body "\x3Ch1>Welcome\x3C/h1>"

# Email with attachment
node scripts/smtp.js send --to [email protected] --subject "Report" --body "Please find attached" --attach report.pdf

# Multiple recipients
node scripts/smtp.js send --to "[email protected],[email protected]" --cc "[email protected]" --subject "Update" --body "Team update"

test

Test SMTP connection by sending a test email to yourself.

node scripts/smtp.js test

Dependencies

npm install

Security Notes

Store credentials in .env (add to .gitignore)
For Gmail: use App Password if 2FA is enabled
For 163.com: use authorization code (授权码), not account password

Troubleshooting

Connection timeout:

Verify server is running and accessible
Check host/port configuration

Authentication failed:

Verify username (usually full email address)
Check password is correct
For 163.com: use authorization code, not account password
For Gmail: use App Password if 2FA enabled

TLS/SSL errors:

Match IMAP_TLS/SMTP_SECURE setting to server requirements
For self-signed certs: set IMAP_REJECT_UNAUTHORIZED=false or SMTP_REJECT_UNAUTHORIZED=false

安全使用建议

This skill appears to implement a legitimate IMAP/SMTP client, but exercise caution before installing: 1) The package includes a .env file with plaintext credentials — do NOT use provided credentials; replace the .env with your own values or keep credentials in a secure secret store. 2) Review the code yourself (imap.js, smtp.js, setup.sh) before running it; the scripts will read and write a .env and will connect to whatever IMAP/SMTP servers you configure. 3) Do not commit your .env to any VCS; add it to .gitignore. 4) If you ran the included .env or used provided credentials, rotate those credentials immediately. 5) If you do not fully trust the publisher, run the code in an isolated environment or container. These mitigations would reduce risk; absence of remote downloads is good, but the included plaintext .env is a notable red flag.

功能分析

Type: OpenClaw Skill Name: imap-smtp-email-chinese Version: 1.1.0 The skill is classified as suspicious due to several critical vulnerabilities. The `setup.sh` script contains a shell injection vulnerability where the `PASSWORD` variable is unquoted when written to the `.env` file, allowing arbitrary command execution during setup if a malicious password string is provided. Additionally, `scripts/imap.js` exposes an arbitrary file write vulnerability via the `download` command's `--dir` and `--file` options, allowing attachments to be saved to any filesystem path. `scripts/smtp.js` exposes an arbitrary file read/exfiltration vulnerability via the `send` command's `--attach`, `--body-file`, `--html-file`, and `--subject-file` options, allowing local files to be read and sent in emails. While these capabilities are plausible for an email client, they represent significant attack surfaces for prompt injection against an AI agent.

能力评估

✓ Purpose & Capability

Name/description align with the actual code: scripts implement IMAP (imapflow/mailparser) and SMTP (nodemailer) operations (check, fetch, download attachments, send). The requested secrets (IMAP/SMTP credentials) are appropriate for the stated functionality.

ℹ Instruction Scope

SKILL.md and scripts instruct the agent to read/create a local .env and run node scripts that connect to IMAP/SMTP servers. These instructions are within scope for an email client skill. Note: the scripts load ../.env (dotenv or manual parsing) and the setup.sh writes .env and runs tests — all of which grant the skill access to any credentials placed in that file (expected for this tool).

✓ Install Mechanism

No remote download/install step is present (instruction-only with included code). Dependencies are standard npm packages (nodemailer, imapflow, mailparser, etc.). Nothing is fetched from arbitrary URLs or shorteners.

⚠ Credentials

The skill legitimately needs IMAP/SMTP credentials, but the repository includes a pre-populated .env file (.env in manifest) containing IMAP_USER/SMTP_USER and IMAP_PASS/SMTP_PASS in plaintext (example: [email protected] / password). Shipping a .env with credentials is a poor security practice and could expose secrets if they are real; the registry metadata also does not declare required env vars (the skill expects them via .env), which is an inconsistency that could confuse automated policy checks.

✓ Persistence & Privilege

always:false, no system-wide config modifications, no self-enabling behavior. setup.sh will create a .env in the skill folder (expected behavior for local configuration). The skill can be invoked autonomously by the agent (platform default), which increases blast radius but is not, by itself, a discrepancy.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install imap-smtp-email-chinese
安装完成后，直接呼叫该 Skill 的名称或使用 /imap-smtp-email-chinese 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.0

修复imap.js若干bug

v1.0.0

感谢@gzlicanyi作者对imap-smtp-email插件的奉献此插件参考imap-smtp-email，并增加了对中文检索邮件的支持

元数据

Slug imap-smtp-email-chinese

版本 1.1.0

许可证 —

累计安装 15

当前安装数 15

历史版本数 2

常见问题