Weekly Report Email

通用周报收集和邮件推送技能，支持交互式填写周报内容，自动计算周数和日期范围，生成美观的HTML格式邮件。

Before installing, note the following: 1) The code expects Node (to run main.js and use nodemailer) and it calls python3 via child_process.execSync to compute ISO week — the skill metadata does not declare these binary requirements; ensure those runtimes exist and are acceptable. 2) The skill will ask you to store SMTP credentials (SMTP_USER/SMTP_PASS, SMTP_FROM) in a .env file inside the skill directory; only provide credentials you trust, and be aware these are persisted on disk. 3) There is no install spec — you may need to run npm install in the skill directory to install nodemailer. 4) The skill uses child_process to run python3 (shell execution) which is a moderate risk surface — review/limit execution environment or sandbox the skill if you have concerns. 5) The SKILL.md emphasizes not auto-sending, but confirm in your environment that the code indeed waits for explicit user confirmation before calling sendWeeklyReport (review main.js/mailerl.js call sites). 6) Minor code smells (duplicate functions in setup.js, absolute path in SKILL.md) are not proof of malice but indicate the package could be sloppy — review the code yourself or run it in an isolated environment. If you decide to proceed: install dependencies locally (npm ci), inspect .env after creation, and consider creating a dedicated SMTP account with limited privileges or an authorization token rather than using your primary mailbox password.

Type: OpenClaw Skill Name: xl-weekly-report-email Version: 1.0.0 The skill bundle is a legitimate utility designed to collect weekly report information through an interactive AI dialogue and send it as a formatted HTML email via SMTP. It uses the standard 'nodemailer' library and stores user-provided credentials locally in a .env file. While the code uses 'child_process.execSync' in main.js to calculate ISO week numbers via a Python snippet, the input is derived from system time and is not user-controlled, posing no RCE risk. The instructions in SKILL.md are focused on ensuring a structured user experience and do not contain malicious prompt injections or attempts to exfiltrate sensitive data.