Post

Manage IMAP email with the Post CLI and local daemon. Use when reading, searching, fetching, drafting, replying, reply-all, moving, archiving, trashing, expo...

This skill appears to do exactly what it says: manage IMAP mail via a local CLI and daemon installed from Homebrew. The main risks are operational: 1) Scoped POST_API_KEY tokens grant mailbox access — only give agents the narrowest token they need, store tokens in a restricted workspace (.env with chmod 600) and rotate/delete tokens when unused. 2) If you configure a daemon hook (command), that script will receive email metadata and a JSON payload and can run arbitrary commands on your machine; only use trusted hook scripts and avoid placing hook scripts in paths writable by untrusted agents. 3) Auto-starting postd via LaunchAgent is normal for a daemon but gives continuous background access to mail; ensure you trust the software and the Homebrew tap. If you want added assurance, review the Homebrew formula source and the upstream GitHub repo releases before installing and restrict agent permissions to scoped tokens rather than full-access credentials.

Type: OpenClaw Skill Name: post Version: 1.5.0 The 'post' skill bundle provides a legitimate interface for managing IMAP email via the Post CLI and daemon on macOS. It includes well-documented procedures for credential management using the macOS Keychain and explicitly encourages the use of scoped API keys to restrict agent access to specific mail servers, which is a strong security practice. While the documentation includes a Python example with a potential shell injection vulnerability (os.system), this is presented as a template for user-defined hooks rather than functional code within the skill itself, and no evidence of intentional malice, data exfiltration, or hidden backdoors was found.