Sendflare

通过 Sendflare SDK 发送带附件的电子邮件，管理联系人列表，支持 CC/BCC 和安全 API 认证。

Security Scan

The skill mostly matches an email-sending/contact-management purpose, but there are multiple mismatches in the metadata and documentation (notably: attachment support claimed in the top-level description but explicitly not supported in the code/README, and registry metadata says no credentials while the packaged skill requires an apiToken), so the package needs clarification before trusting it with secrets.

Purpose & Capability

The code, README, skill.yaml and SKILL.md implement an email-sending and contact-management skill that requires a Sendflare API token (and appId for contacts). However the top-level Description in the registry claims attachment support, while SKILL.md and the code explicitly state "当前版本不支持发送附件" (attachments not supported). Also the registry metadata supplied earlier lists "required env vars: none" and "primary credential: none" which contradicts package/config.schema.json and package/skill.yaml that require a secure apiToken (and appId for some operations). These inconsistencies are unexplained and should be resolved by the publisher.

Instruction Scope

SKILL.md contains only expected instructions: install from marketplace, configure Sendflare API Token, and usage examples. It does not request unrelated system files or other credentials. The runtime code also only accesses the skill config (apiToken) and the Sendflare SDK. There is a TODO/hardcoded placeholder 'from' address ('[e-mail]') in code which means the skill may fail or behave unexpectedly until configured. The SKILL.md was flagged by the pre-scan (base64-block) but that appears to come from compiled source maps in dist/ files rather than malicious prompt injection; still note the scanner hit.

Install Mechanism

No explicit install spec is provided, but the package includes compiled JS and a package.json that depends on 'sendflare-sdk-ts' from the public npm registry. There are no obscure external download URLs; package-lock entries point to npmjs.org. This is a common pattern and not inherently suspicious, but because code is included you should confirm the runtime will install/verify the dependency from the registry and check the provenance of the package (owner, GitHub link).

Credentials

The skill legitimately needs a Sendflare apiToken (declared in package/config.schema.json and skill.yaml) and optionally an appId for contact operations. That is proportionate to the stated functionality. However the registry metadata provided with the submission declares no required env vars/credentials — this mismatch means the skill listing/packaging metadata is out of sync with what the skill actually requires. Only apiToken (and appId for contacts) are required; there are no other unrelated secrets requested.

Persistence & Privilege

The skill does not request 'always: true' and is user-invocable only; it does not modify other skills or system-wide settings. It has a declared network permission to api.sendflare.com which matches its purpose.

Scan Findings in Context

[base64-block] expected: The scanner flagged large base64 blocks. The distributed files include sourceMappingURL data:application/json;base64,... entries (compiled JS sourcemaps). This is expected for packaged/dist JS and not in itself malicious, though the scanner flagged it in SKILL.md which may be a false positive.

What to consider before installing

What to check before installing/use: 1) Metadata mismatch: The top-level description claims attachment support but the README/SKILL.md and the code explicitly say attachments are NOT supported — assume no attachment capability until the publisher clarifies. 2) Credentials: The skill requires a Sendflare apiToken (declared in package/config.schema.json and skill.yaml). The registry metadata incorrectly listed no required credentials — do not trust that older metadata. Only provide the apiToken to skills you trust. Contact management also needs an appId. 3) Sender address: The code currently hardcodes 'from: [e-mail]' (TODO). You will need to ensure you configure a verified sender/domain in Sendflare or edit the skill to set the correct from address. Emails may fail otherwise. 4) Provenance: The package contains a package.json listing 'sendflare-sdk-ts' and references sendflare.com and a GitHub repo. Verify the publisher (owner id and [e-mail]), confirm the GitHub repo is legitimate and matches the packaged code, and prefer installing only from the official marketplace listing. 5) Test safely: If you proceed, test with a limited or throwaway Sendflare API token and low-impact recipient addresses. Monitor network calls and logs. Overall this appears functional for the stated core purpose, but the documentation/metadata inconsistencies should be clarified by the publisher before you provide a real API token or rely on contact-management features.

Sendflare Skill

通过 Sendflare SDK 发送电子邮件的技能。

功能特点

• 📧 发送电子邮件（支持 CC/BCC）
• 🔒 安全的 API 认证
• 📝 完整的 TypeScript 类型定义

功能状态

功能	状态	配置要求
发送邮件	✅ 稳定	apiToken
获取联系人	⚠️ 实验性	apiToken + appId
保存联系人	⚠️ 实验性	apiToken + appId
删除联系人	⚠️ 实验性	apiToken + appId

说明

• 当前版本发信不支持添加附件
• 联系人管理功能需要额外配置 appId
• 发件人地址必须在 Sendflare 后台完成 DNS 验证

安装方法

1. 在 OpenClaw 市场中搜索 "Sendflare"
2. 点击安装
3. 配置你的 Sendflare API Token

配置说明

参数	必填	说明
apiToken	是	Sendflare API 令牌
appId	否	应用 ID（仅联系人功能需要）

使用方法

发送邮件给 [e-mail]，主题：测试邮件，内容：这是一封测试邮件

注意：当前版本不支持发送附件

使用示例

用户: "发送邮件给 [e-mail]，主题：会议通知，内容：明天下午 3 点开会" 技能: "✅ 邮件发送成功！"

注意事项

• 需要有效的 Sendflare API Token
• 发件人地址必须是你验证过的域名

限制

• 速率限制：每分钟 100 次请求
• 不支持附件发送

链接

• Sendflare
• Node.js SDK
• Github

许可证

MIT