Smart Email

AI智能邮件管理助手，支持 QQ、126、163、Outlook 多邮箱 IMAP 收取，本地归档，AI 智能判断紧急邮件，自动发送到用户指定渠道（Telegram/钉钉/企业微信/飞书等）。

Key things to check before installing or enabling this skill: 1) Secrets and env vars: The registry lists no required env vars, but SKILL.md and code require email auth codes and LLM API keys (OpenAI/Anthropic) and likely channel tokens for Telegram/钉钉/飞书/企业微信. Do NOT paste secrets into .env until you review where they are used. Confirm which channel credentials (bot token, webhook, app secret) the dispatch code expects. 2) Review dispatch code: Inspect dispatcher/dispatch-related files to see what external endpoints are used and how credentials are sent. Ensure channel integrations do not leak full email bodies or attachments to unintended endpoints. 3) Privacy of LLM calls: The analyzer code encodes inline images to base64 and sends email text/images to external LLM providers. If you use a third‑party API key, you are sending email content to that vendor. If that is unacceptable, consider using a local/provider you control (subagent) or disable multimodal analysis. 4) Test mode first: Use the provided test-check/test-digest/test-dispatch modes (they claim not to send messages and to use tmp/ paths). Run tests and inspect tmp/outbox/pending to confirm behavior before enabling cron or adding real credentials. 5) Cron and system changes: setup-cron --apply will create recurring jobs. Only run it after you confirm the script behavior and are comfortable with scheduled runs that can access archived emails and credentials. 6) Source provenance: The package contains full source and points to multiple repository URLs in docs; verify the repository origin and check integrity (git remote, commit history) before installing. Avoid blindly running automatic install prompts that fetch code from unknown URLs. 7) Least privilege: Create and supply API keys with the minimal scope possible. If possible, use per-skill accounts/bots (a dedicated Telegram bot, dedicated mailbox or delegated auth) rather than your primary account credentials. If you want, I can: (A) list the exact environment variables and config keys referenced in the code, (B) point out where dispatchers expect channel credentials in the source, or (C) extract the functions that send data externally so you can review them more easily.

Type: OpenClaw Skill Name: smart-email-assistant Version: 2.5.2 The 'Smart Email' skill bundle is a comprehensive AI-powered email management tool that integrates IMAP retrieval, AI analysis (OpenAI/Anthropic/Subagent), and multi-channel notifications (Telegram/DingTalk/etc.). The code logic is well-structured and aligns perfectly with its stated purpose. It uses standard libraries like `imaplib` for email access and the OpenClaw CLI (`openclaw message`, `openclaw cron`) for scheduling and delivery. While it handles sensitive data like email credentials and uses powerful features like `sessions_spawn` for subagents, these actions are transparently documented and necessary for the tool's functionality. No evidence of data exfiltration, malicious prompt injection, or unauthorized persistence was found across the analyzed files (e.g., `src/smart_email/__main__.py`, `src/smart_email/mail_handler.py`, and `SKILL.md`).