Draft Machine
v1.0.0Use this skill whenever the user wants to send a batch of personalized emails, do a mail merge, or draft outreach emails for multiple recipients using Gmail....
⭐ 0· 65·0 current·0 all-time
byJohn Kennedy@audiojak
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the instructions: the skill guides the agent to use the DraftMachine CLI to create Gmail drafts from a CSV and Jinja2/Markdown template. However, the registry metadata lists no required config paths or credentials while the SKILL.md explicitly requires two files in ~/.draftmachine (client_secret.json and creds.json). That mismatch is a documentation/metadata inconsistency (not evidence of malicious intent) and should be noted before install.
Instruction Scope
The SKILL.md stays narrowly focused on preparing CSVs, writing a Jinja2 Markdown template, running a local 'draftmachine' CLI (preview then send), and performing the OAuth setup. It does instruct the agent to write pasted user data to disk (CSV/template), which is within scope for a CLI-oriented mail-merge but is a privacy consideration: user data will be persisted locally.
Install Mechanism
This is an instruction-only skill (no install spec or code). It tells users to install the external package via 'pip install draftmachine' if needed. That is a normal, reasonable mechanism, but because it pulls code from PyPI, users should verify the package and source (PyPI package owner and upstream GitHub) before installing.
Credentials
No environment variables or credentials are declared in the registry metadata, but the runtime instructions require a Google OAuth client_secret.json and a cached creds.json under ~/.draftmachine. Those files and the OAuth flow are proportionate to the stated Gmail-drafts purpose, but the metadata omission is an inconsistency worth noting.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system-wide settings. It requires creating/reading files under ~/.draftmachine and will create Gmail drafts via the user's OAuth token — appropriate for the stated functionality.
Assessment
This skill appears to do what it says (create Gmail drafts from a CSV + template), but before installing/using it you should: 1) Verify the 'draftmachine' pip package and source repository (check PyPI owner and the GitHub repo referenced in README) to ensure you're installing the expected code. 2) Use your own Google Cloud project and create the OAuth client (desktop app) so you control the client_secret.json; confirm the OAuth scopes requested are draft-only. 3) Be careful pasting sensitive data into chat — the skill instructs the agent to write CSV/template files to disk (~/.draftmachine and working dir). 4) Always run the suggested --preview first to validate rendering before creating drafts. 5) Optionally test with a throwaway Gmail account to confirm behavior before running on real recipients. 6) Note the registry metadata omission: the SKILL.md expects ~/.draftmachine/client_secret.json and creds.json even though the skill metadata lists no required config paths; treat that as a documentation inconsistency and verify those files are stored where you expect.Like a lobster shell, security has layers — review code before you run it.
latestvk972bz6c5k94tzbava395z1gx983n6b7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.