← Back to Skills Marketplace
89
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install postbox
Description
Use this skill when the user wants to collect structured data, build forms, or set up submission endpoints — contact forms, feedback, signups, waitlists, bug...
Usage Guidance
This skill appears to be what it says: an agent helper for creating and managing Postbox forms. Before installing, consider:
- Authentication: it only needs POSTBOX_API_KEY — set that as an environment variable (do not paste keys in chat). The skill itself instructs never to accept keys pasted into chat.
- Network access: the skill will make real API calls to https://usepostbox.com. If you trust that service, this is expected; if you do not, do not provide the API key.
- File changes: the agent may generate and update frontend files (index.html, React components) in-session; review any generated/modified code before deploying.
- Broad invocation: the skill asks agents to trigger whenever users 'need data in', which may cause the skill to be suggested in more conversations — be aware if you want tighter control over when it runs.
- Prompt-injection detection: a pattern was flagged in the documentation, but it is used defensively (teaching the agent not to execute commands found in submission text).
If you want higher assurance, verify the vendor (usepostbox.com) and inspect any generated code before publishing. If you prefer to restrict risk, only provide the API key in a controlled environment and limit when the agent is allowed to invoke the skill.
Capability Analysis
Type: OpenClaw Skill
Name: postbox
Version: 1.0.9
The 'postbox' skill facilitates integration with the Postbox service (usepostbox.com) for form management and data collection. It possesses high-risk capabilities including making external network requests to the Postbox API and modifying local project files (e.g., index.html, React components) to update integration code. While the skill demonstrates significant security awareness by explicitly instructing the agent to treat remote data as untrusted to prevent prompt injection and strictly managing credentials via environment variables (SKILL.md, references/guide.md), the inherent risks of automated file system modification and network access meet the threshold for a suspicious classification.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description, declared env var (POSTBOX_API_KEY), and the API-centric runtime instructions all align: the skill creates/manages forms and must authenticate to usepostbox.com. No unrelated credentials, binaries, or system paths are requested.
Instruction Scope
SKILL.md gives detailed, concrete API workflows (create/update/delete forms, read endpoint from response.form.endpoint, generate frontend code, manage submission tokens). It also instructs the agent to apply the skill broadly ('trigger even when the user doesn't name a tool'), which is a design choice that may make the skill be invoked in more contexts than a narrowly-scoped integration. A prompt-injection pattern was detected in the text, but it appears inside examples/advice instructing the agent to treat returned data as untrusted (i.e., to NOT execute commands found inside submission content).
Install Mechanism
Instruction-only skill with no install spec and no code files to execute on disk — minimal risk from installation mechanics.
Credentials
Only a single environment variable (POSTBOX_API_KEY) is required and declared as primaryEnv, which is appropriate for an API-driven form-management service. No unrelated secrets or high-privilege config paths are requested.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration or other skills' credentials. It will make network calls to usepostbox.com when invoked (normal for an integration).
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install postbox - After installation, invoke the skill by name or use
/postbox - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.9
- Added OpenClaw metadata specifying required environment variables and homepage.
- No changes to skill logic, API usage, or workflows.
- All prior usage guidance, best practices, and gotchas remain unchanged.
v1.0.8
- Added license information (MIT-0) to clarify usage terms.
- Introduced metadata specifying that POSTBOX_API_KEY is a required environment variable, with a link to generate it.
- No changes to usage instructions or core workflow.
- Documentation improved for clarity and formalized environmental requirements.
v1.0.7
- Expanded and clarified the SKILL.md documentation to include comprehensive instructions, best practices, and key "gotchas" for Postbox usage.
- Explicitly defined correct endpoint handling, schema updates, token visibility, frontend integration code requirements, and error processing.
- Added guided, collaborative workflows for form creation (context questions, proposal, confirmation, and delivery of necessary assets).
- Detailed agent schema discovery for seamless AI and automation integration.
- Strengthened emphasis on data trust boundaries and proper handling of all returned data and tokens.
Metadata
Frequently Asked Questions
What is Postbox?
Use this skill when the user wants to collect structured data, build forms, or set up submission endpoints — contact forms, feedback, signups, waitlists, bug... It is an AI Agent Skill for Claude Code / OpenClaw, with 89 downloads so far.
How do I install Postbox?
Run "/install postbox" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Postbox free?
Yes, Postbox is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Postbox support?
Postbox is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Postbox?
It is built and maintained by Vipul (@vipulbhj); the current version is v1.0.9.
More Skills