QQ Email with AI

QQ 邮箱智能管理工具。支持收发邮件、搜索筛选、附件处理，以及 AI 智能整理功能（自动摘要、分类、优先级排序、待办提取）。当用户需要操作 QQ 邮箱、查收邮件、发送邮件、整理收件箱或处理邮件相关任务时使用此技能。

Key points to check before installing/using: - Credentials: The registry metadata did not declare required env vars, but the code and SKILL.md expect QQ_EMAIL and QQ_EMAIL_AUTH_CODE (IMAP/SMTP authorization code). AI features require DASHSCOPE_API_KEY. Only set these in an environment you control; treat the QQ auth code like a password and rotate it if exposed. - Privacy: If you enable AI features (or set DASHSCOPE_API_KEY), email subjects/bodies (and possibly extracted attachments) are sent to the DashScope/通义千问 API. Only enable this if you trust that provider and are comfortable with email contents leaving your device. - Missing/verify files: SKILL.md references a download_attachments script that is not present in the provided manifest excerpt — verify the full package contains all referenced scripts (especially any that write files or upload data). Review scripts that handle attachments and sending to ensure they behave as you expect. - Minimal use: If you only need basic send/read/manage features, run scripts without setting the DASHSCOPE_API_KEY or use the provided '--no-ai' / non‑AI options to avoid external API calls. - Audit the code: Because the skill runs locally and connects to your mailbox, inspect scripts (especially send_email, download/attachment handling, and AI call sites) yourself or run them in a restricted/test account first. Consider running in an isolated environment or on a throwaway QQ account until you are confident. - If in doubt: classify this skill as suspicious due to metadata omissions and external AI calls. Ask the publisher to update registry metadata to declare the required env vars and to explicitly state in SKILL.md when/where email contents are sent to third parties.

Type: OpenClaw Skill Name: qq-email-ai Version: 1.0.0 The qq-email-ai skill bundle is a legitimate tool for managing QQ mailboxes with AI-enhanced features like summarization, classification, and task extraction. It uses standard Python libraries (imaplib, smtplib) for email operations and Aliyun's DashScope API for AI processing. The code is well-structured, follows its stated purpose, and handles sensitive credentials (authorization codes and API keys) through environment variables. No evidence of malicious intent, unauthorized data exfiltration, or prompt injection was found across the scripts (e.g., fetch_emails.py, send_email.py, ai_organize.py) or documentation.