执行邮件营销任务，包括群发营销邮件、自动化回信监控、FAQ 知识库智能匹配、语种自动对齐。

This skill contains runnable Python scripts that will need your SMTP/IMAP credentials and local files (Excel, HTML, FAQ). Before running or installing: 1) Treat EMAIL_SMTP_USER / EMAIL_SMTP_PASS (and any IMAP creds) as highly sensitive — avoid using primary/production accounts; create a dedicated test mailbox and rotate credentials after testing. 2) Inspect and correct the path mismatches (SKILL.md expects faq.txt in the skill folder but auto_reply_manager.py points to a hardcoded inbound path). 3) Note that the scripts disable TLS certificate verification (ssl.CERT_NONE) — this is insecure and makes man-in-the-middle attacks possible; fix to validate certificates. 4) The sender code deliberately inserts hidden tags to evade spam filters — this is adversarial and may violate your mail provider's terms or anti-spam laws; review legal/compliance implications. 5) Because the metadata does not declare required env vars, expect the skill to prompt for or require secrets at runtime; do not supply high-privilege credentials without auditing the code. 6) Run in an isolated environment (sandbox or VM) and test with the TEST_EMAIL value set to a controlled address before any bulk send. If you want, I can list exact lines to change to harden the scripts (restore TLS checks, consolidate env var names, update FAQ path) or produce a checklist for safe testing.

Type: OpenClaw Skill Name: email-marketing-3 Version: 0.1.0 The skill is classified as suspicious due to critical security vulnerabilities and risky capabilities. Both `scripts/auto_reply_manager.py` and `scripts/final_sender.py` disable SSL certificate validation (`context.verify_mode = ssl.CERT_NONE`), making email communications vulnerable to Man-in-the-Middle attacks and potential credential compromise. Additionally, `scripts/final_sender.py` includes features like adding hidden 'interference fingerprint' tags and random delays, which are techniques commonly used to evade spam filters, raising concerns about potential misuse for spamming, despite being described as anti-spam measures.