技能详情（站内镜像，无评论）
作者：Lew Cirne @cirne
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.1
统计：⭐ 0 · 34 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：良性
Package：cirne/zmail
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：良性
OpenClaw 评估
zmail's declared requirements and runtime instructions are coherent with a local-first IMAP-to-maildir SQLite email CLI that optionally uses OpenAI for queries; the main risks are expected (npm global install with a native addon and commands that can send email-derived content to OpenAI).
目的
The skill is an agent-first local email CLI and its declared binaries and env vars (node, npm, zmail, ZMAIL_EMAIL, ZMAIL_IMAP_PASSWORD, ZMAIL_OPENAI_API_KEY) align with that purpose. Minor metadata mismatch: registry metadata earlier listed 'Source: unknown' / no homepage while SKILL.md points to github.com/cirne/zmail — verify the package identity on npm/GitHub before installing.
说明范围
SKILL.md limits most commands to local disk (~/.zmail) and SQLite, but explicitly states that `zmail ask`, `zmail inbox`, and `who --enrich` can send email-derived content to OpenAI or third-party APIs. That data flow is documented and expected for those features, but it is a real data-exfiltration surface if you enable those commands with an API key.
安装机制
There is no registry install spec included; the skill instructs a global `npm install -g @cirne/zmail` and notes a `postinstall` rebuild of native `better-sqlite3`. Global npm installs and rebuilding native addons are standard for this kind of tool but carry supply-chain and local-privilege risks; prefer inspecting the package or using `npx`/isolated environments if you have concerns.
证书
Requested config/credentials (email address, IMAP password, OpenAI API key) are proportional to functionality: IMAP access is required to sync mail, and OpenAI key is required only for ask/inbox/enrich features. No unrelated secrets or excessive env variables are requested.
持久
The skill does not request permanent platform-wide presence (always:false) and stores its own data under ZMAIL_HOME (~/.zmail). Commands like `setup --clean --yes` can irreversibly delete its own data, which is documented. It does not claim to modify other skills or global agent settings.
综合结论
This skill appears to do what it says, but check these before installing: 1) Confirm the npm package identity (@cirne/zmail) and inspect the GitHub repo and recent releases; 2) Prefer using `npx @cirne/zmail` or install in an isolated environment/container if you worry about global npm installs and native addon rebuilds; 3) Understand that `zmail ask`, `zmail inbox`, and `who --enrich` can transmit email-derived text to OpenAI or third parties…
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「zmail」。简介：Local-first email for agents: IMAP sync to maildir + SQLite (FTS5); CLI search,…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/cirne/zmail/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。