Aliyun Mail
v1.0.0A skill to send emails via Aliyun enterprise email service with support for markdown, HTML text, attachments, and syntax highlighting for code blocks.
⭐ 0· 1k·2 current·4 all-time
byJixson@jixsonwang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code (email_sender.py) implements an SMTP client that sends plain, HTML, or Markdown emails with attachments and syntax highlighting, which aligns with the skill description (Aliyun enterprise SMTP). The need for a local JSON config file containing SMTP credentials is reasonable for an SMTP tool.
Instruction Scope
SKILL.md and README contain inconsistent instructions and filenames vs. the code: SKILL.md suggests a config named aliyun-mail-config.json in /root/.openclaw/, README uses smtp-config.json, and email_sender.py defaults to ~/.openclaw/smtp-config.json. SKILL.md examples call a CLI 'aliyun-mail send' with flags (--markdown, --html) that do not exist in the shipped Python CLI (email_sender.py uses --type with values 'plain'|'markdown'|'html' and no 'send' subcommand). The tool permits attaching arbitrary filesystem paths and reading body files; while expected for an email sender, this capability can be abused to exfiltrate files if a malicious actor or misconfigured agent supplies system file paths.
Install Mechanism
No install spec; this is instruction+code only. No remote downloads or archive extraction are performed by the skill package itself, which reduces install-time risk.
Credentials
The skill requests no environment variables, instead storing SMTP credentials in a local JSON config file. That is proportionate for SMTP usage, but the documentation's insistence on a /root/.openclaw path is root-centric and may not match the code's ~ expansion if run under a non-root account. The config file will contain sensitive SMTP username/password — that is expected but worth protecting. No other unrelated credentials are requested.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-level privileges or modify other skills. Agent autonomous invocation is enabled by default (disable-model-invocation:false) but this is normal for skills. There is no evidence it modifies other agent settings.
What to consider before installing
This package appears to implement exactly what it claims (an SMTP email sender) but the documentation and CLI examples are inconsistent with the shipped script — double-check before use. Before installing or running: 1) inspect email_sender.py yourself (it is included) to confirm behavior; 2) store SMTP credentials in a secure location and prefer an app-specific password; 3) don't place credentials in world-readable locations and avoid running as root (the docs reference /root but the script uses the current user's home); 4) be cautious when supplying attachments or body-file paths — the tool will read and send any file you point it at, which could leak sensitive files if misused; 5) confirm the expected SMTP endpoint (smtp.mxhichina.com) and the package’s provenance (the repo/homepage referenced in package.json exists but the skill listing shows 'Source: unknown'). If you need the skill, update the docs to match the code (config filename/path and CLI flags) or request an author update; if provenance is unclear, prefer a vetted alternative.Like a lobster shell, security has layers — review code before you run it.
latestvk97a5wxyzg3yaeammq5n76rmgn80t112
License
MIT-0
Free to use, modify, and redistribute. No attribution required.