Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ravi email-send

v2.1.1

Send, compose, reply, reply-all, or forward emails with HTML formatting and attachments. Do NOT use for reading incoming email (use ravi-inbox) or for creden...

0· 543·0 current·0 all-time
byRaunak Singwi@raunaksingwi
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims only to send/compose/reply/forward email, and the SKILL.md is consistent with that purpose (it uses a 'ravi' CLI). However, the manifest declares no required binaries and no primary credential while the runtime instructions explicitly invoke the 'ravi' command-line tool and imply an authenticated Ravi account. The absence of a declared dependency on the 'ravi' binary or any auth credential is an incoherence.
Instruction Scope
The SKILL.md stays within the stated scope (compose, reply, forward, attachment/HTML notes, rate limit handling). It references other Ravi skills (contacts, inbox, email-writing) appropriately. It does not instruct reading arbitrary system files or unrelated environment variables. However, it assumes availability of message IDs and an authenticated CLI session without explaining how those are obtained, which grants implicit authority that is not documented.
Install Mechanism
This is an instruction-only skill with no install spec or code to write to disk, which is low-risk. No downloads or package installs are requested.
!
Credentials
Sending email normally requires account authentication (API key, OAuth token, or an authenticated CLI session). The skill requests no environment variables, no credentials, and no config paths. That is disproportionate: either the skill assumes the environment already has authenticated 'ravi' tooling (not declared), or it omits required secret configuration. The missing credential declaration is a security & operational gap.
Persistence & Privilege
The skill does not request always: true, does not modify other skills, and requires no persistent config. Autonomous invocation is allowed (platform default) but is not combined with other high privileges in this package.
What to consider before installing
This skill's runtime instructions assume a 'ravi' CLI and an authenticated Ravi account but the manifest does not declare the 'ravi' binary or any credentials. Before installing: 1) Ask the publisher which credential or auth flow is required (API key, OAuth, or an already-authenticated CLI session) and how message IDs are supplied. 2) Verify that the 'ravi' CLI is present in the environment and which account it will send from. 3) If you don't already have an authenticated Ravi CLI, treat this as incomplete and don't grant broad agent access until authentication details are provided. 4) Consider limiting agent scope or reviewing logs/approval flows for outbound email to avoid accidental data exfiltration or mass sending.

Like a lobster shell, security has layers — review code before you run it.

latestvk974v435fqy209sssdg14yz97d84f5pz
543downloads
0stars
10versions
Updated 9h ago
v2.1.1
MIT-0

Ravi Email — Send

Compose new emails, reply to existing ones, or forward them from your Ravi email address.

Writing quality matters. Before drafting email content, see the ravi-email-writing skill for subject lines, HTML formatting, tone, and anti-spam best practices.

Resolving Recipients by Name

If you have the recipient's name but not their email address (e.g. "email Alice"), use ravi-contacts first:

# Search contacts by name
ravi contacts search "Alice"
# → Returns matches with email, phone, display_name
# If one match → use the email from the result
# If multiple matches → confirm with the user which Alice they mean
# If no matches → ask the user for the email address directly

Compose a new email

ravi email compose --to "recipient@example.com" --subject "Subject" --body "<p>HTML content</p>"

Arguments:

  • --to (required): Recipient email address
  • --subject (required): Email subject line
  • --body (required): Email body (HTML supported — use tags like <p>, <h2>, <ul> for formatting)

Example with HTML formatting:

ravi email compose \
  --to "user@example.com" \
  --subject "Monthly Report" \
  --body "<h2>Monthly Report</h2><p>Key findings:</p><ul><li>Revenue up 15%</li><li>Churn down 3%</li></ul>"

Reply to an email

# Reply to sender only
ravi email reply <message_id> --body "<p>Reply content</p>"

# Reply to all recipients (reply-all)
ravi email reply-all <message_id> --body "<p>Reply content</p>"

Forward an email

ravi email forward <message_id> --to "recipient@example.com" --body "<p>FYI — see below.</p>"

Arguments:

  • --to (required): Recipient email address
  • --body (required): Email body (HTML supported)

Rate Limits

Email sending is rate-limited per user account:

  • 60 emails/hour and 500 emails/day

On hitting a rate limit, you'll get a 429 response with a retry_after_seconds value. Wait that many seconds before retrying.

Best practices for agents:

  • Avoid tight loops of email sends — batch work where possible
  • On 429: parse retry_after_seconds from the response body, wait, then retry
  • For bulk operations, add a 1-2 second delay between sends

Important Notes

  • HTML email bodies — the --body argument accepts HTML. Use tags for formatting: <p>, <h2>, <ul>, <a href="...">. No <html> or <body> wrapper needed. See ravi-email-writing for templates and anti-spam rules.
  • Subject for replies/forwards — reply and forward commands auto-derive the subject from the original message (prepending Re: or Fwd:). No need to pass --subject.

Full API Reference

For complete endpoint details, request/response schemas, and parameters: Messages | Attachments

Related Skills

  • ravi-contacts — Look up a person's email address by name before sending
  • ravi-email-writing — Subject lines, HTML templates, tone, and anti-spam best practices
  • ravi-inbox — Read incoming email before replying or forwarding
  • ravi-identity — Get your email address and identity name for signatures
  • ravi-feedback — Report deliverability issues or suggest email feature improvements

Comments

Loading comments...