← 返回 Skills 市场
919
总下载
4
收藏
0
当前安装
17
版本数
在 OpenClaw 中安装
/install thrd
功能描述
Provision a dedicated inbox for your AI agent and manage email safely via thrd.email. Includes instant onboarding, inbound polling, reply/send (idempotent +...
安全使用建议
This skill appears to do what it says: provision and operate a dedicated agent inbox on thrd.email. Before installing, consider the following: (1) Keep THRD_API_KEY in a secure runtime secret store (the scripts advise this); only use --reveal-api-key in a trusted terminal. (2) The poll daemon and openapi sync write small local files (.thrd_cursor and .cache/openapi.json) — ensure the agent runtime can accept these files and their locations are acceptable. (3) SKILL.md includes a pip install step (requests only); confirm you want to run pip in the agent environment. (4) Metadata minor inconsistencies exist (no registry install spec, primary credential not declared), but they are not significant for security. If you need stronger assurance, ask the publisher for a provenance/homepage link or run the scripts in an isolated environment and inspect network traffic to ensure they only contact api.thrd.email.
功能分析
Type: OpenClaw Skill
Name: thrd
Version: 1.4.3
The skill bundle is benign. All network requests are directed to the legitimate `api.thrd.email` service. API keys are handled securely by reading from environment variables, with explicit warnings against writing them to disk. Local file system access is limited to caching OpenAPI specifications and persisting a polling cursor, which are legitimate operations for the skill's functionality. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.
能力评估
Purpose & Capability
Name/description (provision/manage an agent inbox via thrd.email) match the actual artifacts: Python scripts call https://api.thrd.email endpoints and requirements list python3 and THRD_API_KEY. The requested binaries and env var are appropriate for this purpose.
Instruction Scope
SKILL.md and scripts instruct the agent to run onboarding, checkout, openapi sync, and a poll daemon. These scripts only interact with the thrd.email API and write two local artifacts: a cache for openapi.json (.cache/openapi.json) and a cursor file (default .thrd_cursor). Onboarding intentionally redacts the API key unless --reveal-api-key is used. The instructions explicitly warn not to persist API keys. Note: onboarding can run without THRD_API_KEY (it provisions and returns a key), while other tools require it — SKILL.md documents this distinction.
Install Mechanism
There is no registry install spec, but SKILL.md suggests running `pip install -r requirements.txt`. requirements.txt lists only 'requests'. This is a low-risk, standard dependency; the install action is local and transparent. (Minor inconsistency: registry metadata listed no install, but the skill provides an install command in SKILL.md.)
Credentials
Only THRD_API_KEY is required, which is proportional to an API-based email tool. Two minor metadata inconsistencies: the registry 'primary credential' field is empty despite THRD_API_KEY being the primary secret, and SKILL.md correctly notes onboarding does not require the env var while other scripts do. No other unrelated secrets or config paths are requested.
Persistence & Privilege
The skill does not request elevated privileges or permanent platform presence (always:false). It writes only its own cache and cursor files and does not attempt to modify other skills or global configs. Autonomous invocation (model invocation allowed) is the platform default and not by itself concerning here.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install thrd - 安装完成后，直接呼叫该 Skill 的名称或使用
/thrd触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.4.3
Security hardening release: removed shell-command execution path from poll daemon, redacted API key by default in onboarding output, and updated docs to safer defaults.
v1.4.2
Docs copy update: removed provider-specific wording from heartbeat guidance. Messaging is now product-agnostic for end users and refers only to THRD monthly send quota.
v1.4.1
Security hardening: removed shell=True from poll_daemon callback execution to eliminate shell-injection risk flagged by scanners. --on-events is now parsed with shlex and executed with shell disabled (argv mode), with validation for malformed command strings. Updated docs to explicitly state safe callback behavior and unsupported shell operators.
v1.4.0
Added wake webhook support for pull runtimes (signed inbox.pending notifications), documented webhook verification flow, and included a poll_daemon fallback script for environments that cannot expose public webhooks.
v1.3.0
Added Sandbox Starter checkout support via plan=sandbox, updated billing guidance for agents near Tier 1 free limits, and refreshed API/skill docs so agents can propose the 9 EUR -> 2,000 emails/month upgrade path to humans.
v1.2.9
Added monthly usage and plan-limit guidance, clarified reply/CC behavior (preserve existing CC on reply), and updated API references for usage visibility and safer runtime operations.
v1.2.8
Fix Tier 1 CC behavior docs and guidance: sandbox replies preserve existing thread CC automatically, and cc[] in Tier 1 is restricted to addresses already present in thread history. Clarified API reference and SKILL usage notes to reduce false upgrade prompts.
v1.2.7
Clarified reply CC behavior (always preserve existing CC; Tier2+ may add cc[]; Tier1 cannot). Updated API reference + security guidance (do not persist API keys to disk).
v1.2.6
Security: stop writing API keys to local files (no thrd_credentials.json).
v1.2.5
Enhanced privacy: API keys are now saved to a local JSON file instead of being printed to stdout logs.
v1.2.4
Standardized metadata (env list format), added requirements.txt, and improved secret handling in scripts.
v1.2.3
Fixed security incoherence: explicitly declared THRD_API_KEY environment variable in metadata.
v1.2.2
Fixed metadata structure and added PoR/Trust Score support. Verified clean structure.
v1.2.1
Bugfix: fixed syntax error in checkout script.
v1.2.0
Added Billing/Upgrade support: agents can now generate Stripe checkout links for their humans.
v1.1.0
Updated for new API changes: optional tenant_name and outbound status tracking.
v1.0.0
Initial release
元数据
常见问题
Thrd Skill 是什么？
Provision a dedicated inbox for your AI agent and manage email safely via thrd.email. Includes instant onboarding, inbound polling, reply/send (idempotent +... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 919 次。
如何安装 Thrd Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install thrd」即可一键安装，无需额外配置。
Thrd Skill 是免费的吗？
是的，Thrd Skill 完全免费（开源免费），可自由下载、安装和使用。
Thrd Skill 支持哪些平台？
Thrd Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Thrd Skill？
由 Thrd.（@sergiorico1）开发并维护，当前版本 v1.4.3。
推荐 Skills