技能 email
📦
v0.0.2 內容修訂 r1 嚴重 🌐 網路存取⚙️ 外部命令📁 檔案系統存取
從 AI 代理程式管理電子郵件
AI 代理程式經常需要以結構化方式存取電子郵件，而不必開啟完整的郵件用戶端。此技能提供基於腳本的 IMAP 和 SMTP 工作流程，用於讀取、列出和傳送訊息。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "email" from https://skillstore.io/skills/7sageer-email.md and its manifest at https://skillstore.io/api/skills/7sageer-email/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「email」。 檢查我最新的五封電子郵件。
預期結果:
一段簡短的收件匣摘要，包含五個項目，每個項目顯示訊息編號、寄件者、主旨、日期和已讀狀態。
正在使用「email」。 以摘要形式讀取第 42 封電子郵件。
預期結果:
一個精簡的訊息檢視，包含寄件者、日期、主旨，以及訊息內文預覽。
正在使用「email」。 將會議筆記傳送給 Pat。
預期結果:
傳送前可供確認的訊息，包含選定的收件者、主旨和純文字內文。
安全審計
嚴重v7 • 2026/7/4 開啟版本化報告
The skill has legitimate IMAP and SMTP functionality, but it also reads macOS Keychain credentials and can send email from a configured account. I confirmed the sensitive credential access and actual send/read behavior, dismissed many Markdown and benign shell redirection false positives, and added semantic findings for personal account data, missing send confirmation, and account-specific mailbox scraping.
8
已掃描檔案
1,250
分析行數
59
複核項目
0
已忽略的誤報
已確認的安全問題 (5)
嚴重
macOS security command
local password=$(security find-generic-password \
The script calls macOS security find-generic-password with -w and stores the mailbox password for IMAP or SMTP use. Reading Keychain secrets is a privileged capability that can expose credentials if the skill is misused.
嚴重
macOS security command
security find-generic-password \
The manual instructs users to run security find-generic-password with -w, which prints a stored password. Normalizing password display creates a credential disclosure risk.
高
Hard-Coded Personal Mail Account
The skill ships SUSTech as the default account with a real mailbox address and display name. This exposes a personal identity and may cause agents to act against the author account if matching Keychain credentials exist.
The account file, skill documentation, and manual all contain the same real mailbox identity and make it the default account. This is direct evidence of user-specific configuration in a public skill.
高
Email Sending Lacks Enforced Confirmation
send-email.sh sends immediately once recipient, subject, and body arguments are present. The skill documentation advises confirmation, but the script does not enforce a confirmation or dry-run step before SMTP upload.
The script validates only required arguments before calling curl to send the message. The only confirmation requirement appears in documentation, so enforcement depends on the agent behavior.
高
Account-Specific Mailbox Search Helper
search-mail.sh searches a hard-coded SUSTech mailbox range for physical fitness related terms and prints matching messages. This is a private, account-specific mailbox scrape rather than a generic marketplace workflow.
The script contains a fixed message ID range, fixed account name, and narrow Chinese search terms, then reads matching messages. That combination strongly indicates a personal mailbox automation artifact.
能力複核項目 (59)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Shell command substitution
local password=$(security find-generic-password \
This command substitution participates in retrieving Keychain-backed email credentials. It is legitimate for the skill, but it is a sensitive external command path.
高
Shell command substitution
IMAP_PASSWORD=$(get_password "$account" "email-imap-${account_lower}" "$IMAP_LOGIN")
This command substitution participates in retrieving Keychain-backed email credentials. It is legitimate for the skill, but it is a sensitive external command path.
高
Shell command substitution
SMTP_PASSWORD=$(get_password "$account" "email-smtp-${account_lower}" "$SMTP_LOGIN")
This command substitution participates in retrieving Keychain-backed email credentials. It is legitimate for the skill, but it is a sensitive external command path.
高
Email sending capability
curl --url "smtps://${SMTP_HOST}:${SMTP_PORT}" \
The script invokes curl against an SMTPS endpoint with sender and account credentials. That is a real outbound email capability that can send mail from the user account.
高
Email sending capability
--mail-from "$SMTP_EMAIL" \
The script invokes curl against an SMTPS endpoint with sender and account credentials. That is a real outbound email capability that can send mail from the user account.
高
Email sending capability
--user "${SMTP_LOGIN}:${SMTP_PASSWORD}" \
The script invokes curl against an SMTPS endpoint with sender and account credentials. That is a real outbound email capability that can send mail from the user account.
中
Email sending capability
smtp:
The active account configuration includes SMTP host, protocol, and credential service information. That enables sending email from the configured mailbox.
中
Email sending capability
host: smtp.exmail.qq.com
The active account configuration includes SMTP host, protocol, and credential service information. That enables sending email from the configured mailbox.
中
Email sending capability
protocol: smtps # smtps = SMTP over TLS
The active account configuration includes SMTP host, protocol, and credential service information. That enables sending email from the configured mailbox.
中
Email sending capability
# 密码从 Keychain 读取: service=email-smtp-sustech
The active account configuration includes SMTP host, protocol, and credential service information. That enables sending email from the configured mailbox.
中
Unix shell invocation
#!/bin/bash
This file is an executable shell script shipped with the skill. The script executes local commands for email operations, so shell execution is a real capability.
中
Email sending capability
# 获取账户的 SMTP 配置
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
get_smtp_config() {
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
export SMTP_HOST=$(get_config "$account" "host" | tail -1)
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
export SMTP_PORT=$(get_config "$account" "port" | tail -1)
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
export SMTP_LOGIN=$(get_config "$account" "login" | tail -1)
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
export SMTP_EMAIL=$(get_config "$account" "email")
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
SMTP_PASSWORD=$(get_password "$account" "email-smtp-${account_lower}" "$SMTP_LOGIN")
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Email sending capability
export SMTP_PASSWORD
The function loads SMTP server, login, sender address, and password into environment variables. This supports authenticated outbound email sending.
中
Shell command substitution
response=$(curl --url "imaps://${IMAP_HOST}:${IMAP_PORT}/${MAILBOX}" \
The command substitution captures curl output from an authenticated IMAP request. This is a real external command that can retrieve mailbox metadata.
中
Shell command substitution
response=$(curl --url "imaps://${IMAP_HOST}:${IMAP_PORT}/${MAILBOX}" \
The command substitution captures curl output from an authenticated IMAP request. This is a real external command that can retrieve mailbox metadata.
中
Unix shell invocation
#!/bin/bash
This file is an executable shell script shipped with the skill. The script executes local commands for email operations, so shell execution is a real capability.
中
Shell command substitution
log_file="$(mktemp)"
The script creates temporary files used while fetching and parsing private email content. mktemp is appropriate, but the workflow still handles sensitive mailbox data on disk.
中
Shell command substitution
EML_FILE="$(mktemp)"
The script creates temporary files used while fetching and parsing private email content. mktemp is appropriate, but the workflow still handles sensitive mailbox data on disk.
中
Shell command substitution
BODY_FILE="$(mktemp)"
The script creates temporary files used while fetching and parsing private email content. mktemp is appropriate, but the workflow still handles sensitive mailbox data on disk.
中
Unix shell invocation
#!/bin/bash
This file is an executable shell script shipped with the skill. The script executes local commands for email operations, so shell execution is a real capability.
中
Shell command substitution
for i in $(seq 600 855); do
The script uses shell commands to iterate a hard-coded mailbox range and invoke read-email.sh. That is a real automation path for bulk mailbox inspection.
中
Shell command substitution
subject=$(./read-email.sh -a SUSTech -f headers $i 2>/dev/null | grep "^Subject:" || true)
The script uses shell commands to iterate a hard-coded mailbox range and invoke read-email.sh. That is a real automation path for bulk mailbox inspection.
中
Unix shell invocation
#!/bin/bash
This file is an executable shell script shipped with the skill. The script executes local commands for email operations, so shell execution is a real capability.
中
Shell command substitution
TEMP_FILE=$(mktemp)
The script creates a temporary message file containing outgoing email content. mktemp is appropriate, but private message text can briefly exist on disk.
中
Unix shell invocation
#!/bin/bash
This file is an executable shell script shipped with the skill. The script executes local commands for email operations, so shell execution is a real capability.
中
Email sending capability
get_smtp_config "$ACCOUNT" || exit 1
The send script builds and displays an outgoing SMTP message using the configured sender. This is part of real email sending behavior.
中
Email sending capability
From: $SMTP_EMAIL
The send script builds and displays an outgoing SMTP message using the configured sender. This is part of real email sending behavior.
中
Email sending capability
echo " 从: $SMTP_EMAIL"
The send script builds and displays an outgoing SMTP message using the configured sender. This is part of real email sending behavior.
中
Email sending capability
Email operations skill for sending, fetching, and reading emails via IMAP/SMTP.
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
This skill provides email capabilities through direct IMAP/SMTP protocol access using curl. It suppo
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- **Sending emails** via SMTP with TLS
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- **Protocol**: Direct IMAP (port 993) and SMTP (port 465) over TLS
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
Send emails via SMTP with support for inline or file-based content.
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
smtp:
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
host: smtp.exmail.qq.com
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
protocol: smtps
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
# SMTP password
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
-s "email-smtp-sustech" \
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- SMTP: `email-smtp-{account_name_lowercase}`
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- Check if IMAP/SMTP is enabled in email provider settings
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- Check firewall settings for ports 993 (IMAP) and 465 (SMTP)
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- SMTP: smtp.exmail.qq.com:465 (SSL/TLS)
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- Requires IMAP/SMTP enabled in settings
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- SMTP: smtp.gmail.com:587 (STARTTLS)
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
- SMTP: smtp.office365.com:587
The skill instructions explicitly describe SMTP sending and provider settings. Skill documentation is operational guidance for agents and confirms the email capability.
中
Email sending capability
# SMTP 密码(如果与 IMAP 相同,可以使用同一个)
The user manual documents SMTP password and server setup. This supports the skill ability to send authenticated email.
中
Email sending capability
-s "email-smtp-sustech" \
The user manual documents SMTP password and server setup. This supports the skill ability to send authenticated email.
中
Email sending capability
- SMTP 服务器:smtp.exmail.qq.com:465 (SSL/TLS)
The user manual documents SMTP password and server setup. This supports the skill ability to send authenticated email.
中
Email sending capability
- 需要在企业邮箱设置中开启 IMAP/SMTP 服务
The user manual documents SMTP password and server setup. This supports the skill ability to send authenticated email.
低
Temp file creation
log_file="$(mktemp)"
The read script stores fetched email content in temporary files for parsing. mktemp and cleanup reduce risk, but private mailbox data can briefly exist on disk.
低
Temp file creation
EML_FILE="$(mktemp)"
The read script stores fetched email content in temporary files for parsing. mktemp and cleanup reduce risk, but private mailbox data can briefly exist on disk.
低
Temp file creation
BODY_FILE="$(mktemp)"
The read script stores fetched email content in temporary files for parsing. mktemp and cleanup reduce risk, but private mailbox data can briefly exist on disk.
低
Temp file creation
TEMP_FILE=$(mktemp)
The send script writes outgoing message content to a temporary file before upload. mktemp is safer than a fixed path, but email contents can briefly exist on disk.
風險因素
🌐 網路存取 (48)
references/accounts.yaml:19 references/accounts.yaml:20 references/accounts.yaml:23 references/accounts.yaml:24 references/accounts.yaml:35 references/accounts.yaml:36 references/accounts.yaml:39 scripts/common.sh:55 scripts/common.sh:56 scripts/common.sh:60 scripts/common.sh:61 scripts/common.sh:62 scripts/common.sh:63 scripts/common.sh:65 scripts/common.sh:69 scripts/send-email.sh:64 scripts/send-email.sh:71 scripts/send-email.sh:90 scripts/send-email.sh:94 scripts/send-email.sh:96 scripts/send-email.sh:98 SKILL.md:69 SKILL.md:281 SKILL.md:282 SKILL.md:283 SKILL.md:284 SKILL.md:6 SKILL.md:21 SKILL.md:22 SKILL.md:29 SKILL.md:38 SKILL.md:106 SKILL.md:107 SKILL.md:110 SKILL.md:125 SKILL.md:128 SKILL.md:135 SKILL.md:213 SKILL.md:218 SKILL.md:236 SKILL.md:237 SKILL.md:243 SKILL.md:249 SKILL.md:282 USER_MANUAL.md:17 USER_MANUAL.md:20 USER_MANUAL.md:45 USER_MANUAL.md:46
⚙️ 外部命令 (87)
scripts/common.sh:4 scripts/common.sh:13-16 scripts/common.sh:41 scripts/common.sh:43 scripts/common.sh:44 scripts/common.sh:45 scripts/common.sh:46 scripts/common.sh:48 scripts/common.sh:58 scripts/common.sh:60 scripts/common.sh:61 scripts/common.sh:62 scripts/common.sh:63 scripts/common.sh:65 scripts/common.sh:1 scripts/fetch-emails.sh:6 scripts/fetch-emails.sh:56-58 scripts/fetch-emails.sh:74 scripts/fetch-emails.sh:75 scripts/fetch-emails.sh:79 scripts/fetch-emails.sh:91 scripts/fetch-emails.sh:97-99 scripts/fetch-emails.sh:1 scripts/read-email.sh:7 scripts/read-email.sh:108 scripts/read-email.sh:306 scripts/read-email.sh:327 scripts/read-email.sh:328 scripts/read-email.sh:350 scripts/read-email.sh:351 scripts/read-email.sh:352 scripts/read-email.sh:353 scripts/read-email.sh:354 scripts/read-email.sh:355 scripts/read-email.sh:381 scripts/read-email.sh:384 scripts/read-email.sh:1 scripts/search-mail.sh:4 scripts/search-mail.sh:8 scripts/search-mail.sh:9 scripts/search-mail.sh:1 scripts/send-email.sh:6 scripts/send-email.sh:67 scripts/send-email.sh:1 SKILL.md:32 SKILL.md:36 SKILL.md:41-45 SKILL.md:45-48 SKILL.md:48-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51-52 SKILL.md:52-53 SKILL.md:53-55 SKILL.md:55-60 SKILL.md:60-64 SKILL.md:64-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-71 SKILL.md:71-76 SKILL.md:76-80 SKILL.md:80-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-92 SKILL.md:92-94 SKILL.md:94-111 SKILL.md:111-117 SKILL.md:117-131 SKILL.md:131-134 SKILL.md:134-135 SKILL.md:135-143 SKILL.md:143-149 SKILL.md:149-155 SKILL.md:155-158 SKILL.md:158-164 SKILL.md:164-166 SKILL.md:166-187 SKILL.md:187-189 SKILL.md:189 SKILL.md:195-198 SKILL.md:198-239 SKILL.md:239 SKILL.md:180-183 SKILL.md:166-187
📁 檔案系統存取 (20)
scripts/common.sh:5 scripts/common.sh:16 scripts/fetch-emails.sh:90 scripts/read-email.sh:67 scripts/read-email.sh:100 scripts/read-email.sh:115 scripts/read-email.sh:117 scripts/read-email.sh:150 scripts/read-email.sh:269 scripts/read-email.sh:324 scripts/read-email.sh:381 scripts/read-email.sh:108 scripts/read-email.sh:327 scripts/read-email.sh:328 scripts/search-mail.sh:9 scripts/send-email.sh:67 SKILL.md:144 SKILL.md:156 SKILL.md:167 SKILL.md:196
偵測到的模式
macOS security command×2
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/7sageer-email/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/7sageer-email?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/7sageer-email?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/7sageer-email/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/7sageer-email.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
7Sageer, Claude. (2026). email security audit report (audit version 7) [Author version 0.0.2]. Skillstore. https://skillstore.io/skills/7sageer-email/audits/7BibTeX 引用
@techreport{7sageer-claude-7sageer-email-2026,
author = {7Sageer, Claude},
title = {email security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/7sageer-email/audits/7},
note = {Author version 0.0.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "email security audit report (audit version 7)"
version: "0.0.2"
type: report
authors:
- name: "7Sageer, Claude"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/7sageer-email/audits/7"
identifiers:
- type: other
value: "skillstore:7sageer-email:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 64
架構
100
可維護性
87
內容
70
社群
91
規範符合度
你可以打造什麼
檢查近期收件匣活動
列出最新訊息的寄件者、主旨、日期和已讀狀態，以便快速分類處理。
傳送營運更新
在確認詳細資訊後，從已設定的信箱傳送簡潔的純文字通知。
讀取訊息脈絡
擷取選定訊息，讓助理能摘要或擷取關鍵細節。
試試這些提示
檢查我的收件匣
檢查我的預設收件匣，並摘要最近五封電子郵件的寄件者、主旨和日期。
讀取一封訊息
讀取我收件匣中的第 12 封電子郵件，並給我一段簡短摘要，包含任何被要求的行動。
草擬並傳送更新
在向我顯示收件者、主旨和內文以供確認後，傳送一封關於專案狀態的純文字電子郵件給 Alex。
分類處理信箱資料夾
檢視我 Sent 資料夾中最新的 20 封訊息，找出需要追蹤的項目，並只讀取理解脈絡所需的訊息。
最佳實務
- 在發布或分享前，將所有範例帳戶值替換為你自己的預留位置。
- 在傳送任何訊息前，要求使用者明確確認。
- 當供應商支援時，使用 app-specific passwords 或有限範圍的憑證。
避免
- 不要發布以真實個人信箱作為預設帳戶的技能。
- 不要要求助理將 Keychain 密碼列印到聊天或記錄中。
- 除非使用者要求確切範圍，否則不要執行廣泛的信箱搜尋。
常見問題
此技能可以傳送電子郵件嗎？
可以。它會透過 curl 使用 SMTP 和已設定的帳戶憑證。
密碼儲存在哪裡？
腳本會從 macOS Keychain service entries 讀取密碼。
它支援 Gmail 或 Outlook 嗎？
它記錄了 IMAP 和 SMTP 設定，但未實作現代 OAuth 流程。
它可以讀取完整電子郵件內文嗎？
可以。讀取腳本可以輸出摘要、標頭、內文或完整訊息。
它會處理附件嗎？
不可以。附件處理被列為未來增強功能。
它已準備好用於公開 marketplace 嗎？
不修改的話不行。個人帳戶詳細資訊和有風險的電子郵件操作需要更安全的預設值。
開發者詳細資訊
授權
MIT
作者版本
v0.0.2
Skillstore 修訂
r1
引用
e9e4712298ed071d92417a41714be123eb8364fa
維護新鮮度
2026/7/18
使用量
10 次下載 · 172 次瀏覽
檔案結構