← Back to Skills Marketplace
890
Downloads
0
Stars
2
Active Installs
4
Versions
Install in OpenClaw
/install gmail-label-manager
Description
Automatically organizes unread Gmail messages by applying relevant labels, removing irrelevant ones, and archiving emails based on patterns from archived mes...
README (SKILL.md)
Gmail Label Manager Skill
This skill automates the organization of unread Gmail messages by applying labels, removing unnecessary labels, and archiving emails, based on predefined patterns from archived emails.
Features
-
Automated Workflow Steps:
- Finds the first unread email.
- Identifies the appropriate label using:
- Dynamic analysis of labels on archived emails from the same sender.
- Ignores labels from emails still in the inbox.
- Adds the determined label(s) to the unread email.
- Removes irrelevant label(s) from the email. Also remove irrelevant CATEGORY labels (
CATEGORY_PERSONAL,CATEGORY_PROMOTIONS,CATEGORY_UPDATES,UNREAD, etc.). - Archives the email by removing the
INBOXlabel. - Verifies the operation to ensure all changes are applied correctly.
-
Customizable Patterns:
- Dynamically learns from archived emails—no static cache required.
- Reduces dependency on external configurations.
Installation
Requirements:
- Install the
gogCLI and authenticate it for Gmail API access.
Skill Setup:
- Place the skill files inside your OpenClaw workspace.
- Modify paths within the script for your local setup if required.
Testing the Workflow
- Run the
script.shmanually or as part of a larger pipeline to confirm functionality before deploying automatic runs. - Test with a mix of labeled archived emails and unlabeled inbox emails to ensure accuracy.
Usage Guidance
This skill includes a large shell script that does most of the real work — do not run it blindly. Before installing or running: 1) Open script.sh and search for any network calls (curl, wget, nc, telegram API usage) — if present, understand what data is sent and where. 2) Remove or sandbox any hard-coded personal names/domains if you will reuse the skill for others. 3) Be cautious about providing TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID — those env vars are not declared by the skill but the script will use them if set and can forward data to Telegram. 4) Ensure required binaries (gog, jq) are installed and that you authenticate 'gog' to a Gmail account you control/test with only non-sensitive messages. 5) Consider running the script in an isolated environment (throwaway Gmail account, container) and monitor network traffic to confirm no unexpected exfiltration. 6) If you need this functionality but want safer behavior, request a version that documents dependencies, removes hidden control characters, and makes any telemetry (e.g., Telegram) opt-in and explicitly documented.
Capability Analysis
Type: OpenClaw Skill
Name: gmail-label-manager
Version: 1.0.3
The `script.sh` contains a critical Remote Code Execution (RCE) vulnerability in the `add_calendar_event` function, where it uses `eval` to execute a command string constructed from potentially unsanitized email content (e.g., subject, description). A malicious email could craft content to inject arbitrary shell commands. Additionally, the script is designed to extract and send a wide range of sensitive personal information (financial, health, family, security alerts) to Telegram, which, while intended functionality, poses a significant data exposure risk if the Telegram bot token or chat ID are compromised.
Capability Assessment
Purpose & Capability
The SKILL.md and script both describe classifying and labeling Gmail messages (needs a Gmail-capable CLI such as 'gog'), which is coherent. However the skill metadata declares no required env vars or binaries while the script clearly expects additional tools (jq, gog) and optional Telegram credentials — a mismatch.
Instruction Scope
SKILL.md instructs installing 'gog' and running script.sh. The script, however, reads a local config.json, writes logs, contains many hard-coded personal/family identifiers and domains, and references Telegram logging variables and files not mentioned in SKILL.md. These additional behaviors expand scope beyond the documented workflow and could expose sensitive email content.
Install Mechanism
No install spec (instruction-only) — nothing is downloaded or executed automatically by an installer. Risk from install mechanism itself is low, but running the included script will write files to disk (logs) and may perform network calls.
Credentials
The skill registry lists no required environment variables, but the script expects TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID (and implicitly requires tools like jq and a Gmail-authenticated 'gog' CLI). Telegram credentials can be used to send messages (potential exfiltration). Multiple sensitive domains/names are hard-coded, which is unusual for a general-purpose skill.
Persistence & Privilege
always:false (normal). The script creates local logs and config files in its own directory (local persistence) but does not request system-wide configuration changes. The combination of local logs plus optional Telegram forwarding increases the blast radius for sensitive data, but there is no indication it modifies other skills or global agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install gmail-label-manager - After installation, invoke the skill by name or use
/gmail-label-manager - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.3
- No visible changes to documentation or feature set in this version.
- Internal update made to script.sh; user-facing behavior and instructions remain unchanged.
v1.0.2
- Updated script.sh with minor changes (details not specified).
- No changes to documentation or features in SKILL.md.
v1.0.1
- Removed obsolete and auxiliary files, simplifying the skill package.
- script.sh is now the only script required for operation.
- Eliminated use of cached label data and external label management scripts.
- Skill now relies solely on dynamic analysis from archived emails.
v1.0.0
Gmail Label Manager v1.0.0
- Introduces automated workflow to organize unread Gmail messages by applying, removing, and updating labels based on patterns from archived emails.
- Dynamically analyzes archived emails from the same sender to determine relevant labels.
- Removes unnecessary and category labels, then archives emails by removing the INBOX label.
- No static cache or configuration required—learns directly from archived messages.
- Includes setup and testing instructions for integration with workflow pipelines.
Metadata
Frequently Asked Questions
What is Gmail Label Manager?
Automatically organizes unread Gmail messages by applying relevant labels, removing irrelevant ones, and archiving emails based on patterns from archived mes... It is an AI Agent Skill for Claude Code / OpenClaw, with 890 downloads so far.
How do I install Gmail Label Manager?
Run "/install gmail-label-manager" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Gmail Label Manager free?
Yes, Gmail Label Manager is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Gmail Label Manager support?
Gmail Label Manager is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Gmail Label Manager?
It is built and maintained by Coenenp (@coenenp); the current version is v1.0.3.
More Skills