Inbox Triage Bot

AI-powered email triage via IMAP (himalaya) or Google API. Fetches inbox, classifies messages by urgency, recommends actions, and generates daily markdown di...

Security Scan

The instructions describe a plausible email-triage tool, but the skill bundle is incomplete and mismatched (it asks you to run npm/himalaya commands and supply mail credentials while the package contains no code or declared env requirements), so proceed with caution.

Purpose & Capability

The stated purpose (IMAP via himalaya or Google API) matches the required binaries (himalaya, node). However the skill package contains only SKILL.md and no code or package.json, yet the instructions tell the user/agent to run npm install and npm run scripts. Also the registry metadata claims no required env vars while the README references Gmail App Password or Google OAuth and an optional OPENAI_API_KEY. These mismatches suggest packaging or documentation errors.

Instruction Scope

SKILL.md tells the agent to cd into a workspace path, run npm install, run npm scripts (demo, email:fetch, etc.), copy .env.example, and run himalaya commands that will access mailboxes. Those runtime instructions will attempt to access local filesystem, install packages, and require mail credentials. Given the skill bundle contains no code, following these instructions as-is will either fail or cause the agent to run commands in directories that may not contain the expected files—this is scope creep and an operational risk.

Install Mechanism

No install spec (instruction-only), which is lower risk in principle. But the guidance expects the user/agent to run npm install at runtime against a repository that is not included in the skill bundle; that pushes installation/ download decisions onto the user/agent and increases risk if the external repo is unverified.

Credentials

The instructions require sensitive credentials (Gmail App Password or Google OAuth creds) and optionally an OPENAI_API_KEY, yet the skill metadata declares no required env vars or primary credential. The skill instructs copying an .env.example (not included) and storing OAuth/App Password credentials locally. Requesting mail account credentials is expected for an email triage tool, but the omission from metadata and lack of included code to audit raises proportionality and transparency concerns.

Persistence & Privilege

always is false and there is no install-time code that requests persistent privileges. The skill does instruct adding a cron job (user-level) to run the demo and write a markdown file, which is normal for a digest tool. Autonomous invocation (model calls) is allowed by default — not flagged here — but combine that with credential access only if you trust the implementation.

What to consider before installing

This skill's README describes a reasonable email-triage tool, but the bundle only contains SKILL.md and no code or declared environment requirements. Before installing or running anything: 1) inspect the referenced GitHub repo (https://github.com/gruted/inbox-triage-bot) — do not run npm install or scripts until you trust that code; 2) understand it needs access to your mailbox (Gmail App Password or OAuth) and possibly an OpenAI key — only provide credentials you control and rotate them after testing; 3) avoid blindly following the cron example until you confirm the demo script behaves as expected; 4) prefer running the tool in an isolated environment/container and review all scripts the first time; 5) ask the publisher to correct metadata (declare required env vars and include code or clarify that this skill only documents an external project) if you want to proceed with more confidence.

AI email triage — fetch, classify, and report on your inbox.

Quick start

cd ~/.openclaw/workspace/skills/inbox-triage-bot
npm install
EMAIL_BACKEND=himalaya npm run demo

What it does

• Fetches recent emails via IMAP (himalaya) or Google API
• Classifies by urgency and category (AI or heuristic)
• Recommends actions per message
• Pulls upcoming calendar events
• Generates markdown daily digest reports

Backends

himalaya (recommended — no OAuth)

Requires himalaya CLI configured with a Gmail App Password:

himalaya envelope list -f INBOX -s 5  # test
EMAIL_BACKEND=himalaya npm run demo

Google API (alternative)

Requires OAuth credentials:

cp .env.example .env  # edit with OAuth creds
npm run google:oauth:init
npm run demo

Commands

npm run demo              # full triage report (markdown)
npm run email:fetch       # raw envelopes (JSON)
npm run email:triage      # classified envelopes (JSON)
npm run calendar:upcoming # upcoming events (JSON)

Environment variables

Variable	Default	Description
EMAIL_BACKEND	auto	himalaya or google
HIMALAYA_ACCOUNT	gru_gmail	himalaya account name
OPENAI_API_KEY	—	Optional AI classification

Cron

# Daily at 7 AM
0 7 * * * cd /path/to/inbox-triage-bot && EMAIL_BACKEND=himalaya npm run demo >> ~/inbox-triage.md 2>&1

Links

• GitHub: https://github.com/gruted/inbox-triage-bot
• Landing page: https://gruted.github.io/inbox-triage-bot/