nmail

Command-line tool to send, read, and manage Korean Naver and Daum emails via nmail with JSON outputs and account configuration.

Things to check before installing or enabling this skill: - Verify binary provenance: the registry metadata contains no install spec even though a full Go source tree is included and README suggests 'brew' or 'go install'. If you will run a prebuilt nmail binary, obtain it from a trusted source (official GitHub release or build the source yourself and inspect it). Do not run an unverified binary. - Credentials: nmail stores app passwords in ~/.nmail/config.yaml (0600). That is expected for an email client but is sensitive. If possible, prefer using system keychain storage or ensure the agent process is trusted and the config file is protected. - Declared dependencies mismatch: SKILL.md shows piping watch output into the external 'openclaw' CLI, but the skill metadata does not declare that binary as required. If an agent automates this, ensure the openclaw CLI used is the one you expect. - Build & review: because source is present, consider auditing or building the Go code locally and verifying behavior (especially config file handling and network connections to IMAP/SMTP hosts) before granting runtime access. - If you need lower blast radius: run the nmail binary in an isolated environment (container or dedicated agent role) and avoid giving the agent access to unrelated files or credentials. Given the inconsistencies (missing install spec, undeclared binaries, plaintext config), proceed only after verifying the binary/source and considering how app passwords are stored.

Type: OpenClaw Skill Name: nmail Version: 0.2.0 The nmail skill bundle is a legitimate CLI tool designed for managing Korean email services (Naver, Daum) via IMAP and SMTP. The code implements standard email operations including account configuration, inbox listing, message reading, searching, and sending, with specific support for Korean character encodings (EUC-KR). Credentials are stored locally in `~/.nmail/config.yaml` with appropriate file permissions (0600). No evidence of data exfiltration, unauthorized network calls, or malicious prompt injection was found; the instructions in SKILL.md correctly guide the agent on how to use the tool for its stated purpose.