AI-powered email triage that syncs with your calendar and drafts responses for efficient inbox management.

Before installing/running this skill: 1) Confirm the missing registry metadata: skill.yaml requires OPENAI_API_KEY (and optional email/calendar tokens) but the registry listing shows no required env — ask the publisher to correct this. 2) Understand privacy: by default the pipelines send email bodies to OpenAI (OPENAI_API_KEY). If your emails are sensitive, use the listed local backend (ollama) or another local model, or avoid using OpenAI. 3) Network exposure: the MCP pipeline binds to 0.0.0.0:${PORT}; do not run it on a public-facing host or without proper firewall/authentication. 4) Deployment: the SKILL.md includes a deploy to skills.expanso.io — deploying moves the pipeline to an external environment (read the cloud provider's privacy policy before doing so). 5) Credentials: store tokens securely (not checked into repos) and only provide the minimum required scopes for email/calendar APIs. 6) Test first with dummy/sample emails to confirm behavior and outputs. If you want to proceed, ask the publisher to fix the registry metadata discrepancy and to document whether any telemetry or external logging occurs during runtime.

Type: OpenClaw Skill Name: expanso-email-triage Version: 1.0.0 The skill bundle is classified as benign. It performs its stated purpose of AI-powered email triage, sending email content to OpenAI for classification as expected. The `SKILL.md` and AI prompts are task-focused and do not contain prompt injection attempts. While the pipelines currently simulate email fetching, the design explicitly states that sensitive credentials (email/calendar tokens) are intended to remain local and not be transmitted, which is a good security practice. There is no evidence of unauthorized data exfiltration, malicious execution, persistence mechanisms, or obfuscation.