← Back to Skills Marketplace
weipengcopyright

Envelope Sender

by Wesley · GitHub ↗ · v1.0.2 · MIT-0
cross-platform ⚠ suspicious
288
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install envelope-sender
Description
Guide agent to send a user-specified local PDF document for signature through eSignGlobal by calling the eSignGlobal CLI tool.eSignGlobal CLI is an agent-fri...
README (SKILL.md)

Envelope Sender

Use this skill to send a single local PDF document for signature with eSignGlobal through an external CLI.

Installation

Use the external CLI through npx:

npx @esignglobal/envelope-cli \x3Ccommand>

Setup

Before calling any send action, set ESIGNGLOBAL_APIKEY in the shell environment.

# Windows PowerShell
$env:ESIGNGLOBAL_APIKEY="your_api_key"

# macOS / Linux
export ESIGNGLOBAL_APIKEY="your_api_key"

# Verify connectivity
npx @esignglobal/envelope-cli config health

Credential handling rules:

  • The CLI reads credentials only from ESIGNGLOBAL_APIKEY
  • Do not implement local credential storage inside this skill
  • Do not print or persist secrets

Workflow

  1. Collect a single absolute filePath, signer list, and optional subject
  2. Confirm the file is a .pdf and the signer data is complete
  3. Set ESIGNGLOBAL_APIKEY in the current shell session
  4. Run the external CLI command to send the envelope
  5. Return the CLI result to the user

Safety Rules

  • Only use a file path the user explicitly provided for this task
  • Only handle one local PDF file per run
  • Refuse relative paths; require an absolute path to a .pdf file
  • Reject any non-PDF file before invoking the CLI
  • Never print or persist secrets
  • Do not scan directories, expand globs, or discover files on the user's behalf
  • Only call the trusted eSignGlobal CLI configured for this environment

Required Inputs

  • filePath: absolute path to an existing local PDF file
  • signers: JSON array of signer objects
  • subject: optional email or envelope subject

Each signer must include:

  • userName
  • userEmail

Optional field:

  • signOrder as an integer >= 1

Input Format

filePath

filePath must be an absolute path to an existing local PDF file.

Example:

/tmp/contract.pdf

signers

Each signer must include:

  • userName
  • userEmail

Optional field:

  • signOrder (integer, minimum 1)

Single signer example:

[
  {
    "userName": "Bob Smith",
    "userEmail": "[email protected]"
  }
]

Sequential signing example:

[
  {
    "userName": "Bob Smith",
    "userEmail": "[email protected]",
    "signOrder": 1
  },
  {
    "userName": "Alice Jones",
    "userEmail": "[email protected]",
    "signOrder": 2
  }
]

Parallel signing example:

[
  {
    "userName": "Bob Smith",
    "userEmail": "[email protected]",
    "signOrder": 1
  },
  {
    "userName": "Alice Jones",
    "userEmail": "[email protected]",
    "signOrder": 1
  }
]

External CLI Pattern

Use the external command-line tool instead of bundled scripts:

npx @esignglobal/envelope-cli send-envelope --file \x3CfilePath> --signers '\x3CsignersJson>' [--subject \x3Csubject>] --confirm

Check available commands if needed:

npx @esignglobal/envelope-cli help

Example:

npx @esignglobal/envelope-cli send-envelope --file "C:\\docs\\contract.pdf" --signers '[{"userName":"Bob Smith","userEmail":"[email protected]"}]' --subject "Please sign this contract" --confirm

Required Configuration

  • Node.js 18 or later
  • Access to the trusted external CLI, either preinstalled or available through npx
  • ESIGNGLOBAL_APIKEY must already be configured in the shell environment

Output

Return the external CLI result. Do not bundle or implement upload logic inside this skill.

Usage Guidance
This skill appears to do what it says (send a local PDF via the eSignGlobal CLI) and only needs your ESIGNGLOBAL_APIKEY and a single absolute PDF path. Before installing/using it: (1) Ensure you trust the npm package @esignglobal/envelope-cli and its publisher—npx will fetch and run code from the registry. Prefer preinstalling a vetted binary or pinning a specific package version (e.g., @esignglobal/[email protected]) to avoid unexpected updates. (2) Verify the package source (GitHub repo, maintainer) and review its code if possible. (3) Do not pass sensitive files—only provide the specific PDF you intend to send. (4) Make sure ESIGNGLOBAL_APIKEY is set in the environment and that you understand which account it maps to. (5) Note the small metadata inconsistency: registry shows no required env vars while the skill expects ESIGNGLOBAL_APIKEY—confirm this with the publisher or only run in an environment you control.
Capability Analysis
Type: OpenClaw Skill Name: envelope-sender Version: 1.0.2 The skill bundle instructs the agent to execute shell commands via `npx @esignglobal/envelope-cli` using user-provided inputs like `filePath` and a JSON string for `signers`. This pattern is highly vulnerable to shell injection (RCE) if the agent does not perfectly escape the inputs before execution. While the `SKILL.md` includes commendable safety rules (e.g., absolute path enforcement, PDF validation, and secret handling), the inherent risk of shell interpolation and the use of `npx` to fetch external code, combined with a future-dated `publishedAt` timestamp (2026) in `_meta.json`, warrants a suspicious classification.
Capability Assessment
Purpose & Capability
The skill's stated purpose (send a local PDF via the eSignGlobal CLI) aligns with the single primary credential (ESIGNGLOBAL_APIKEY) and the SKILL.md workflow. Minor inconsistency: registry metadata lists no required env vars while SKILL.md and metadata block declare ESIGNGLOBAL_APIKEY as the primaryEnv.
Instruction Scope
SKILL.md limits behavior to a single, user-provided absolute PDF path, validates file type, and instructs using the external CLI via npx. It explicitly forbids scanning directories, glob expansion, printing or persisting secrets, and only asks for inputs needed for the task.
Install Mechanism
There is no install spec; runtime use of `npx @esignglobal/envelope-cli` means the agent will fetch and execute code from the npm registry at runtime. The SKILL.md does not pin a package version or provide a checksum, increasing risk if the package or its maintainer is compromised.
Credentials
Requesting ESIGNGLOBAL_APIKEY is proportional to the stated task. However, the registry metadata omission of required env vars is a small inconsistency. The skill expects Node.js 18+, which is reasonable but not declared in registry 'required binaries'.
Persistence & Privilege
The skill does not request always-on presence, does not modify other skills, and is instruction-only. It does require the agent to execute an external CLI at runtime but does not request persistent agent-level privileges.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install envelope-sender
  3. After installation, invoke the skill by name or use /envelope-sender
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Added metadata section specifying ESIGNGLOBAL_APIKEY as the primary environment variable.
v1.0.1
**Switched from internal TypeScript script to external eSignGlobal CLI tool for envelope sending.** - Updated documentation to reflect the shift to external CLI use.
v1.0.0
envelope-sender v1.0.0 - Initial release. - Guides users through previewing and sending a single local PDF for signature via eSignGlobal. - Strictly enforces explicit file path, signer, and subject review before upload. - Requires explicit user confirmation prior to any network operation. - Only supports absolute paths to local PDF files; rejects all others. - Provides commands for preview (`plan` mode) and send (`send --confirm` mode) actions. - Outputs JSON results for both preview and send steps.
Metadata
Slug envelope-sender
Version 1.0.2
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 3
Frequently Asked Questions

What is Envelope Sender?

Guide agent to send a user-specified local PDF document for signature through eSignGlobal by calling the eSignGlobal CLI tool.eSignGlobal CLI is an agent-fri... It is an AI Agent Skill for Claude Code / OpenClaw, with 288 downloads so far.

How do I install Envelope Sender?

Run "/install envelope-sender" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Envelope Sender free?

Yes, Envelope Sender is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Envelope Sender support?

Envelope Sender is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Envelope Sender?

It is built and maintained by Wesley (@weipengcopyright); the current version is v1.0.2.

💬 Comments