da-fu-da-gui

智能邮箱自动回复工具，实时监测新邮件，自动发送自定义模板回复，支持多邮箱集成，防止重复回复。

Security Scan

The skill promises automatic email monitoring and replies but gives no details about how it will obtain or store mailbox credentials or tokens, leaving a mismatch between claimed capability and requested/declared access.

Purpose & Capability

The skill's purpose (real-time monitoring and sending replies for Gmail/Outlook) inherently requires mailbox access (OAuth tokens, SMTP/IMAP or API credentials), but the metadata declares no required credentials, env vars, or config paths. That omission is inconsistent: a genuine email-integration skill should declare or document how it will obtain and store account credentials.

Instruction Scope

SKILL.md is vague about the actual runtime actions: it tells the user to 'authorize and bind your email account' and that the skill will run in the background, but provides no guidance on the authorization method, what exact permissions are requested (read/send/delete), what data is logged, or where tokens/settings are stored. The instructions grant broad discretion and could lead to the agent requesting or storing sensitive credentials without clear constraints.

Install Mechanism

There is no install spec and no code files beyond small template files; being instruction-only reduces disk-write risk. Nothing is downloaded or executed by the skill itself according to the manifest.

Credentials

No environment variables, credentials, or config paths are declared even though the feature set requires mailbox credentials. This mismatch prevents a clear review of required secrets and is disproportionate to the stated capability.

Persistence & Privilege

The skill is not marked always:true, which is good, but it is allowed to be invoked autonomously. Combined with email send/read capability (implied by purpose), autonomous operation increases risk (mass replies, accidental data leakage). The manifest does not clarify retention or revocation of any bound credentials.

What to consider before installing

Before installing: 1) Ask the publisher how account authorization works — require OAuth flows with explicit scopes (read/send) rather than raw passwords. 2) Verify where and how authorization tokens/credentials are stored, who can access them, and how to revoke them. 3) Confirm what exact permissions the skill will request and that it will not delete or forward emails without consent. 4) Test the skill on a disposable or test mailbox first to observe behavior and automatic replies. 5) Prefer skills from known sources with a privacy policy; if the source is unknown and you cannot get answers to the above, avoid granting mailbox access. 6) Limit automatic replies with whitelists/blacklists and review reply history regularly to prevent spam or data leaks.

技能名称：智能邮箱自动回复

技能简介

本技能可自动处理你的邮件收件箱，在新邮件到达时，根据邮件内容，自动生成并发送合适的回复。支持自定义回复模板，适合商务、客服、个人自动回复等多种场景。

主要功能

• 实时检测新邮件，并自动发送回复
• 支持自定义回复模板（基于发件人/主题关键词）
• 可与多种邮箱（如Gmail、Outlook）集成
• 自动记录已回复历史，防止重复发送

使用方法

1. 在 ClawHub 中安装本技能。
2. 进入技能设置，授权并绑定你的邮箱账号。
3. 编辑或选择自动回复模板，也可以按关键字设置不同回复内容。
4. 保存设置，技能即自动开始在后台工作。

实际用例

• 客户询盘自动回复：当客户发来邮件咨询时，自动回复：“您好，我们已经收到您的来信，会尽快有专人联系您。”
• 节假日自动告知：在节假日，自动回复说明公司放假时间，处理延迟说明等。

注意事项

• 建议定期检查自动回复逻辑，防止误回复。
• 回复模板支持变量：如插入发件人姓名、时间等信息。