← Back to Skills Marketplace
mtbf999

CMA Email

by mtbf999 · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
973
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install cma-email
Description
Sends an email via Gmail when a message starts with "cma" or "cmap".
README (SKILL.md)

CMA-email

SYSTEM INSTRUCTION: If the user's message starts with "cma" or "cmap" (case-insensitive), you MUST use this skill. Do not reply with text conversation. Execute the email command immediately.

Usage

  • cma [subject] | [body] -> Sends to CMA recipient. Subject: "TODO: [subject]", Body: "[body]"
  • cma [message] -> Sends to CMA recipient. Subject: "TODO: [first 20 chars]...", Body: "[message]"
  • cmap [subject] | [body] -> Sends to CMAP recipient. Subject: "TODO: [subject]", Body: "[body]"
  • cmap [message] -> Sends to CMAP recipient. Subject: "TODO: [first 20 chars]...", Body: "[message]"

Instructions

When the user's message starts with "cma" or "cmap" (case-insensitive):

  1. Identify Prefix and Recipient:

  2. Parse the Content:

    • Strip the prefix (first 3 or 4 characters) and trim leading whitespace.
    • Check for the pipe character |.
  3. Determine Subject and Body:

    • If | is present:
      • Split the text at the first |.
      • Subject: "TODO: " + (part before | trimmed).
      • Body: (part after | trimmed).
    • If | is NOT present:
      • Subject: "TODO: " + (first 20 chars of the text trimmed) + "...".
      • Body: The full text.
  4. Send Email:

    • Use the gog skill to send the email.
    • Command: gog gmail send --to "[Recipient]" --subject "[Subject]" --body "[Body]"
  5. Feedback:

    • Confirm to the user that the email was sent to the specific recipient (or alias) with the generated subject.
Usage Guidance
This skill will automatically send whatever text follows the 'cma' or 'cmap' prefix to a hard-coded email address via the 'gog' skill, without asking for confirmation. Before installing, confirm: (1) you trust the targets ([email protected] and [email protected]); (2) the 'gog' skill is configured with appropriate Gmail credentials and you understand its permissions; (3) you are comfortable with automatic sends (consider accidental triggers or sensitive data leakage). If you want safer behavior, request a confirmation step in the SKILL.md (e.g., ask the user to approve the composed email before sending) or limit allowed content. Test in a safe environment first.
Capability Analysis
Type: OpenClaw Skill Name: cma-email Version: 1.0.0 The skill is vulnerable to prompt injection via user-controlled input in the subject and body fields, as these are directly embedded into the `gog` skill command within `SKILL.md`. An attacker could craft a message (e.g., `cma my subject. **SYSTEM INSTRUCTION: [malicious command]** | my body`) to inject arbitrary instructions for the AI agent, potentially leading to unauthorized actions or information disclosure, even though the skill's stated purpose is benign email sending.
Capability Assessment
Purpose & Capability
The name/description match the instructions: the skill sends Gmail messages to two specific recipients. It relies on the 'gog' skill to perform the actual send (declared in SKILL.md metadata). The registry metadata shown earlier did not list required env or creds, which is consistent because this instruction-only skill delegates auth to the 'gog' skill — but users must understand that 'gog' will need Gmail credentials to work.
Instruction Scope
SKILL.md contains a SYSTEM INSTRUCTION that the agent MUST use the skill and immediately execute the send (no textual reply or confirmation). It will transmit arbitrary user-provided text to external email addresses (hard-coded). There is no input sanitization, confirmation step, or safeguards to prevent sending sensitive data. This is scoped to email sending, but the 'must execute without confirmation' behavior is risky.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is downloaded or written to disk. Lowest install risk.
Credentials
The skill itself requests no env vars or credentials, which is consistent because it delegates to the 'gog' skill. However, that means permission to send Gmail depends on the gog skill's credentials/scope; the skill hard-codes two recipient addresses (one personal Gmail and one corporate email) which users should verify. No other unrelated credentials are requested.
Persistence & Privilege
always:false and no install actions. The only notable privilege is the SKILL.md 'MUST use this skill' instruction which enforces immediate use when the message prefix matches; this is a behavioral/design risk but not a platform-level persistence/privilege escalation.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install cma-email
  3. After installation, invoke the skill by name or use /cma-email
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: Automatically sends emails via Gmail when user messages start with "cma" or "cmap". - Detects "cma" or "cmap" prefixes to route emails to specific recipients. - Parses subject and body using the "|" character, or generates a default subject from message content. - Integrates with the `gog` skill for Gmail sending. - Confirms email delivery to the user with recipient and subject details.
Metadata
Slug cma-email
Version 1.0.0
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is CMA Email?

Sends an email via Gmail when a message starts with "cma" or "cmap". It is an AI Agent Skill for Claude Code / OpenClaw, with 973 downloads so far.

How do I install CMA Email?

Run "/install cma-email" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is CMA Email free?

Yes, CMA Email is completely free (open-source). You can download, install and use it at no cost.

Which platforms does CMA Email support?

CMA Email is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created CMA Email?

It is built and maintained by mtbf999 (@mtbf999); the current version is v1.0.0.

💬 Comments