Custom Smtp Sender

A skill to send emails with support for markdown, HTML text, and attachments, leveraging existing SMTP configuration in `/home/bb/.openclaw/smtp-config.json`. Includes retry logic and logging.

Security Scan

The skill purports to send email using a local SMTP config but its metadata omits the required config/credential declaration and the SKILL.md promises features (retries, logging, CLI name) that the shipped code does not implement — this mismatch is suspicious and should be verified before use.

Purpose & Capability

The skill's stated purpose (sending email via existing SMTP config) matches the code's behavior (email_sender.py reads /home/bb/.openclaw/smtp-config.json and uses smtplib). However the registry metadata claimed no required config paths or credentials, which is incorrect: the code will unconditionally read a user-specific config file containing SMTP username/password. Also the SKILL.md shows a CLI called 'custom-smtp-sender' but no wrapper/installation is provided — the repository only contains a Python script, so the promised CLI name and distribution are inconsistent.

Instruction Scope

SKILL.md describes retries, logging, and advanced behavior, but the provided email_sender.py contains no retry logic and no explicit logging/audit trail. The runtime instructions encourage attaching arbitrary files; while that is expected for an email sender, the skill will read arbitrary local files passed as attachments (and a body-file) and transmit them — the metadata did not declare that file access/exfiltration capability. The instructions also reference a specific config path (/home/bb/.openclaw/smtp-config.json) that is not declared in the registry.

Install Mechanism

No install spec is provided (instruction-only), which reduces supply-chain risk. However the package includes a Python script intended to be run as a CLI; there is no installer or wrapper that provides the 'custom-smtp-sender' command referenced in SKILL.md. Users would need to run the script directly or create their own wrapper.

Credentials

The skill requires SMTP credentials (username/password) stored in a local JSON file, but the registry metadata lists no required credentials or config paths. That is a material omission: the skill will access a sensitive local file without declaring it. Requesting a file containing SMTP credentials can be legitimate for an email sender, but the lack of disclosure and the hard-coded, user-specific path (/home/bb/...) are disproportionate and surprising.

Persistence & Privilege

The skill does not request persistent/autonomous privileges (always: false) and does not modify other skills or system-wide settings. It does perform network I/O (SMTP) when invoked, which is expected for its purpose.

What to consider before installing

This skill is internally inconsistent in ways that matter for security. Before installing or running it: 1) Review and confirm the SMTP config file path and contents — the code reads /home/bb/.openclaw/smtp-config.json and will use whatever credentials are stored there; ensure that's intended and secured. 2) Don't assume retries or logging exist — the code lacks retry logic and explicit logging despite SKILL.md claims. 3) The SKILL.md references a 'custom-smtp-sender' CLI but only a Python script is provided; you will need to run the script directly or create a wrapper. 4) Treat attachments/body-file behavior carefully: the script will read any local file you point it to and send it over the network; only attach files you trust. 5) If you want to use this skill, consider editing the code to (a) accept a configurable config path or environment variables instead of a hard-coded /home/bb path, (b) add explicit retry and logging as promised, and (c) validate/limit attachment paths. 6) If you are unsure about the source, run it in an isolated environment or container and inspect/modify the code before providing any credentials.

Custom skill to send emails with advanced options including HTML/Markdown conversion, attachments, and retry handling. Integrates existing configuration, ensuring secure and reliable operations.

Features

• HTML/Markdown support: Compose emails using markdown converted to HTML.
• Attachments: Include one or more files easily.
• Retries: Attempts to resend in case of temporary failures.
• Logging: Maintains a log of sent emails and errors for auditing.

Prerequisites

• SMTP Configuration File: smtp-config.json located at /home/bb/.openclaw/

Example:

{
  "server": "smtp.exmail.qq.com",
  "port": 465,
  "username": "[e-mail]",
  "password": "your-password",
  "emailFrom": "[e-mail]",
  "useTLS": true
}

Ensure file permissions are secured (chmod 600).

Usage

Send a basic email:

custom-smtp-sender send --to "[e-mail]" --subject "Hello" --body "你好"

Send an HTML email with an attachment:

custom-smtp-sender send \
  --to "[e-mail]" \
  --subject "Weekly Report" \
  --body "**Important updates inside.** See attached." \
  --html \
  --attachments path/to/file.pdf

Error Handling

The tool retries up to 3 times on failure, logging each attempt. Networking or credential issues are reported in detail.

Future Expansion

• Support for CC/BCC fields
• Scheduling emails (cron integration)
• Email templates

Set up your SMTP-service once, and you’re ready to integrate email into your workflow!