Campaign Tracker

客户开发信追踪与分析 — 自动归档发送记录、匹配客户回复、生成效果分析报告、优化邮件模板

This skill appears to implement campaign tracking and reporting, but it expects to read files and modules from other skills (e.g. EMAIL_SKILL_ROOT) and even loads a .env from that location — which may contain IMAP/SMTP credentials or other secrets. Before installing or running: 1) Inspect the scripts yourself (archive-sent-records.js, reply-matcher.js, analytics-report.js, template-optimizer.js) — they will be executed by node. 2) Do not point EMAIL_SKILL_ROOT to a live production skill directory that contains credentials unless you have reviewed and sanitized its .env and scripts. 3) Prefer running first in dry-run mode and in an isolated/test environment (or container) so it cannot read unrelated files. 4) Verify what OKKI_VECTOR_SEARCH should point to and whether it invokes remote services or scripts. 5) If you need to use this, explicitly set the required environment variables to trusted, minimal locations and avoid sharing cross-skill secrets. Providing explicit documentation from the author that clarifies which env vars are required and that the skill will not load other skills' secrets would reduce risk and could change this assessment to 'benign'.

Type: OpenClaw Skill Name: ssa-campaign-tracker Version: 1.0.0 The ssa-campaign-tracker bundle is a legitimate tool designed for tracking email marketing performance, archiving sent records, and generating analytics reports. The scripts (analytics-report.js, archive-sent-records.js, reply-matcher.js, and template-optimizer.js) perform standard file-based data processing using Node.js built-in modules like 'fs' and 'path'. While reply-matcher.js uses a dynamic require() to integrate with an external intent-recognition module, this is consistent with the stated integration with the 'imap-smtp-email' skill. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.