atomicmail-46b42b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited atomicmail-46b42b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Atomic Mail exposes a programmable inbox over JMAP with PoW signup and JWT rotation. This skill ships a single CLI entrypoint with three commands: `register`, `jmap_request`, and `help` — matching the MCP server.
In this skill runtime, atomicmail help --topic readme intentionally returns a short stub.
Call `atomicmail help` early and often — before guessing placeholders, using URNs, or cron setup. Start with help --topic overview, then presets before custom jmap_request calls and cron after register. If installed behavior disagrees with docs elsewhere, trust help from the running package.
npx --package=@atomicmail/agent-skill-gh-pages atomicmail register --username "myagent"
npx --package=@atomicmail/agent-skill-gh-pages atomicmail jmap_request --ops-file list_inbox.jsonRun `atomicmail --help` or `atomicmail <command> --help` for flags.
authUrl: https://auth.atomicmail.aiapiUrl: https://api.atomicmail.ai~/.atomicmailnpx --package=@atomicmail/agent-skill-gh-pages atomicmail register \
--username "alice"Writes credentials.json, session.jwt, capability.jwt. Prints JSON including inbox and accountId.
Required next step: after register, arrange hourly inbox polling per your runtime (see Hourly inbox polling). Native cron hosts schedule an agent job with list_inbox.json; hosts without native cron should ask the operator or remind manual fetch. Do not cron atomicmail jmap_request alone.
Usernames must be 5–21 characters (local-part of your @atomicmail.ai address).
If credentials already exist for a different username, register fails by default to protect the old account. To add another inbox without replacing the current one, pass a separate --credentials-dir (MCP: credentials_dir on register / jmap_request). Use --forced only when you intend to replace credentials in the same directory (after backing it up).
npx --package=@atomicmail/agent-skill-gh-pages atomicmail register \
--api-key "..."npx --package=@atomicmail/agent-skill-gh-pages atomicmail jmap_request \
--ops '[["Mailbox/get", {"accountId": "$ACCOUNT_ID"}, "m0"]]'$ACCOUNT_ID, $INBOX, $INBOX_MAILBOX_ID, $UPLOAD_URL, and $DOWNLOAD_URL resolve from the session/credentials. Other placeholders such as $TO or $SUBJECT require --vars with a JSON object of strings (same substitution applies to --ops and --ops-file).
Preset file:
npx --package=@atomicmail/agent-skill-gh-pages atomicmail jmap_request \
--ops-file list_inbox.jsonWith custom placeholders:
npx --package=@atomicmail/agent-skill-gh-pages atomicmail jmap_request \
--ops-file send_mail.json \
--vars '{"TO":"[email protected]","SUBJECT":"Hello","BODY":"Hi there"}'Bundled presets (no local file creation required):
send_mail.json ($TO, $SUBJECT, $BODY)send_mail_attachment.json ($TO, $SUBJECT, $BODY, $ATTACHMENT_BASE64,$ATTACHMENT_TYPE, $ATTACHMENT_NAME)
send_mail_blob_attachment.json ($TO, $SUBJECT, $BODY; pair withrepeatable `--attachment PATH` for RFC 8620 upload → $ATTACHMENT_0_BLOB_ID, …)
list_inbox.json (latest 50; uses $INBOX_MAILBOX_ID) — used for hourly inbox pollingreply.json ($MAIL_ID, $BODY)Registration only creates credentials. Inbound mail should be fetched and triaged about once per hour between interactive sessions.
Choose the path that matches your runtime — do not mix platforms.
OpenClaw, Hermes, atomic-agent, and similar hosts with native cron: set up an hourly agent job after the first successful register. Wire Atomic Mail MCP or AgentSkill into that agent. The scheduled turn should call list_inbox.json inside the agent prompt.
Claude, Pi, Cursor, and other chat agents without a cron API: do not spend tokens trying to work around this — no wrapper scripts, OS crontab/LaunchAgent setup, or scheduling on a different platform.
After register, either ask your operator to set up hourly polling on a capable host (share the examples below), or remind your operator to fetch mail manually when needed.
Do not register in one runtime and schedule the cron job on another (e.g. Pi runs register, then creates an OpenClaw cron job).
Do not cron atomicmail jmap_request alone (no agent). Do not use headless one-shot CLIs (claude -p, pi -p, codex exec) if you want to continue the thread.
| Your setup | Approach |
|---|---|
| OpenClaw | openclaw cron add with --announce |
| Hermes | hermes cron create or /cron with --deliver |
| Atomic Bot | Same as OpenClaw or Hermes |
| atomic-agent | atomic-agent task create --cron |
| No native cron (Claude, Pi, Cursor, …) | Ask operator to schedule on a capable host, or remind manual fetch |
Full options, agent prompt, and operator OS-scheduling notes: atomicmail help --topic cron or MCP help topic cron.
Use Atomic Mail to fetch my inbox (MCP jmap_request with ops_file list_inbox.json, or atomicmail jmap_request --ops-file list_inbox.json). Summarize new messages, highlight what needs a reply, and stay available — I may ask you to reply, forward, search, or dig into something important.OpenClaw — cron docs: isolated session, --announce for delivery.
Hermes — cron docs: --deliver origin (or telegram, discord, email, …); not --no-agent.
atomic-agent — atomic-agent task create --cron "0 * * * *" --message "<prompt>"
For operator OS-scheduling patterns on terminal hosts, see help --topic cron.
npx --package=@atomicmail/agent-skill-gh-pages atomicmail help
npx --package=@atomicmail/agent-skill-gh-pages atomicmail help --topic jmap_cheatsheetcredentials.json holds the API key (mode 0600). Do not commit it.Use `send_mail_attachment.json` (in-band base64) or `send_mail_blob_attachment.json` with repeatable `--attachment PATH` (RFC 8620 upload — same flow as MCP `attachments`). Rules, limits, and Blob/upload JSON shape: `atomicmail help --topic jmap_cheatsheet`.
npx --package=@atomicmail/agent-skill-gh-pages atomicmail jmap_request \
--ops-file send_mail_attachment.json \
--vars '{"TO":"[email protected]","SUBJECT":"Hi","BODY":"See file","ATTACHMENT_BASE64":"SGVsbG8=","ATTACHMENT_TYPE":"text/plain","ATTACHMENT_NAME":"note.txt"}'--auth-url, --api-url or ATOMIC_MAIL_AUTH_URL,ATOMIC_MAIL_API_URL
--credentials-dir or ATOMIC_MAIL_CREDENTIALS_DIR--scrypt-salt or ATOMIC_MAIL_SCRYPT_SALT~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.