← 返回 Skills 市场
weipengcopyright

Envelope Sender

作者 Wesley · GitHub ↗ · v1.0.2 · MIT-0
cross-platform ⚠ suspicious
288
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install envelope-sender
功能描述
Guide agent to send a user-specified local PDF document for signature through eSignGlobal by calling the eSignGlobal CLI tool.eSignGlobal CLI is an agent-fri...
使用说明 (SKILL.md)

Envelope Sender

Use this skill to send a single local PDF document for signature with eSignGlobal through an external CLI.

Installation

Use the external CLI through npx:

npx @esignglobal/envelope-cli \x3Ccommand>

Setup

Before calling any send action, set ESIGNGLOBAL_APIKEY in the shell environment.

# Windows PowerShell
$env:ESIGNGLOBAL_APIKEY="your_api_key"

# macOS / Linux
export ESIGNGLOBAL_APIKEY="your_api_key"

# Verify connectivity
npx @esignglobal/envelope-cli config health

Credential handling rules:

  • The CLI reads credentials only from ESIGNGLOBAL_APIKEY
  • Do not implement local credential storage inside this skill
  • Do not print or persist secrets

Workflow

  1. Collect a single absolute filePath, signer list, and optional subject
  2. Confirm the file is a .pdf and the signer data is complete
  3. Set ESIGNGLOBAL_APIKEY in the current shell session
  4. Run the external CLI command to send the envelope
  5. Return the CLI result to the user

Safety Rules

  • Only use a file path the user explicitly provided for this task
  • Only handle one local PDF file per run
  • Refuse relative paths; require an absolute path to a .pdf file
  • Reject any non-PDF file before invoking the CLI
  • Never print or persist secrets
  • Do not scan directories, expand globs, or discover files on the user's behalf
  • Only call the trusted eSignGlobal CLI configured for this environment

Required Inputs

  • filePath: absolute path to an existing local PDF file
  • signers: JSON array of signer objects
  • subject: optional email or envelope subject

Each signer must include:

  • userName
  • userEmail

Optional field:

  • signOrder as an integer >= 1

Input Format

filePath

filePath must be an absolute path to an existing local PDF file.

Example:

/tmp/contract.pdf

signers

Each signer must include:

  • userName
  • userEmail

Optional field:

  • signOrder (integer, minimum 1)

Single signer example:

[
  {
    "userName": "Bob Smith",
    "userEmail": "[email protected]"
  }
]

Sequential signing example:

[
  {
    "userName": "Bob Smith",
    "userEmail": "[email protected]",
    "signOrder": 1
  },
  {
    "userName": "Alice Jones",
    "userEmail": "[email protected]",
    "signOrder": 2
  }
]

Parallel signing example:

[
  {
    "userName": "Bob Smith",
    "userEmail": "[email protected]",
    "signOrder": 1
  },
  {
    "userName": "Alice Jones",
    "userEmail": "[email protected]",
    "signOrder": 1
  }
]

External CLI Pattern

Use the external command-line tool instead of bundled scripts:

npx @esignglobal/envelope-cli send-envelope --file \x3CfilePath> --signers '\x3CsignersJson>' [--subject \x3Csubject>] --confirm

Check available commands if needed:

npx @esignglobal/envelope-cli help

Example:

npx @esignglobal/envelope-cli send-envelope --file "C:\\docs\\contract.pdf" --signers '[{"userName":"Bob Smith","userEmail":"[email protected]"}]' --subject "Please sign this contract" --confirm

Required Configuration

  • Node.js 18 or later
  • Access to the trusted external CLI, either preinstalled or available through npx
  • ESIGNGLOBAL_APIKEY must already be configured in the shell environment

Output

Return the external CLI result. Do not bundle or implement upload logic inside this skill.

安全使用建议
This skill appears to do what it says (send a local PDF via the eSignGlobal CLI) and only needs your ESIGNGLOBAL_APIKEY and a single absolute PDF path. Before installing/using it: (1) Ensure you trust the npm package @esignglobal/envelope-cli and its publisher—npx will fetch and run code from the registry. Prefer preinstalling a vetted binary or pinning a specific package version (e.g., @esignglobal/[email protected]) to avoid unexpected updates. (2) Verify the package source (GitHub repo, maintainer) and review its code if possible. (3) Do not pass sensitive files—only provide the specific PDF you intend to send. (4) Make sure ESIGNGLOBAL_APIKEY is set in the environment and that you understand which account it maps to. (5) Note the small metadata inconsistency: registry shows no required env vars while the skill expects ESIGNGLOBAL_APIKEY—confirm this with the publisher or only run in an environment you control.
功能分析
Type: OpenClaw Skill Name: envelope-sender Version: 1.0.2 The skill bundle instructs the agent to execute shell commands via `npx @esignglobal/envelope-cli` using user-provided inputs like `filePath` and a JSON string for `signers`. This pattern is highly vulnerable to shell injection (RCE) if the agent does not perfectly escape the inputs before execution. While the `SKILL.md` includes commendable safety rules (e.g., absolute path enforcement, PDF validation, and secret handling), the inherent risk of shell interpolation and the use of `npx` to fetch external code, combined with a future-dated `publishedAt` timestamp (2026) in `_meta.json`, warrants a suspicious classification.
能力评估
Purpose & Capability
The skill's stated purpose (send a local PDF via the eSignGlobal CLI) aligns with the single primary credential (ESIGNGLOBAL_APIKEY) and the SKILL.md workflow. Minor inconsistency: registry metadata lists no required env vars while SKILL.md and metadata block declare ESIGNGLOBAL_APIKEY as the primaryEnv.
Instruction Scope
SKILL.md limits behavior to a single, user-provided absolute PDF path, validates file type, and instructs using the external CLI via npx. It explicitly forbids scanning directories, glob expansion, printing or persisting secrets, and only asks for inputs needed for the task.
Install Mechanism
There is no install spec; runtime use of `npx @esignglobal/envelope-cli` means the agent will fetch and execute code from the npm registry at runtime. The SKILL.md does not pin a package version or provide a checksum, increasing risk if the package or its maintainer is compromised.
Credentials
Requesting ESIGNGLOBAL_APIKEY is proportional to the stated task. However, the registry metadata omission of required env vars is a small inconsistency. The skill expects Node.js 18+, which is reasonable but not declared in registry 'required binaries'.
Persistence & Privilege
The skill does not request always-on presence, does not modify other skills, and is instruction-only. It does require the agent to execute an external CLI at runtime but does not request persistent agent-level privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install envelope-sender
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /envelope-sender 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.2
- Added metadata section specifying ESIGNGLOBAL_APIKEY as the primary environment variable.
v1.0.1
**Switched from internal TypeScript script to external eSignGlobal CLI tool for envelope sending.** - Updated documentation to reflect the shift to external CLI use.
v1.0.0
envelope-sender v1.0.0 - Initial release. - Guides users through previewing and sending a single local PDF for signature via eSignGlobal. - Strictly enforces explicit file path, signer, and subject review before upload. - Requires explicit user confirmation prior to any network operation. - Only supports absolute paths to local PDF files; rejects all others. - Provides commands for preview (`plan` mode) and send (`send --confirm` mode) actions. - Outputs JSON results for both preview and send steps.
元数据
Slug envelope-sender
版本 1.0.2
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 3
常见问题

Envelope Sender 是什么?

Guide agent to send a user-specified local PDF document for signature through eSignGlobal by calling the eSignGlobal CLI tool.eSignGlobal CLI is an agent-fri... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 288 次。

如何安装 Envelope Sender?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install envelope-sender」即可一键安装,无需额外配置。

Envelope Sender 是免费的吗?

是的,Envelope Sender 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Envelope Sender 支持哪些平台?

Envelope Sender 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Envelope Sender?

由 Wesley(@weipengcopyright)开发并维护,当前版本 v1.0.2。

💬 留言讨论