Reply.io CLI

Manage sequences, contacts, email accounts, and schedules in Reply.io directly from the terminal. Use this skill when users want to view Reply.io stats, mana...

Security Scan

The skill is internally consistent with its stated purpose (a thin wrapper/instructions for running the official reply-cli) and only requires the Reply.io API key it declares.

Purpose & Capability

Name, description, declared binaries (node) and required env var (REPLY_API_KEY) match the behavior: the skill invokes the reply-cli via npx. The inclusion of curl in the declared binaries is slightly unnecessary given the provided files and instructions, but not a strong mismatch.

Instruction Scope

SKILL.md instructs the agent to run npx reply-cli commands and to avoid logging the API key. The provided reply.sh only reads the API key (from env or /run/secrets/reply_key) and forwards args to npx. There are no instructions to read unrelated files, exfiltrate data, or call unexpected endpoints.

Install Mechanism

There is no install spec (instruction-only) and the included script uses npx to fetch/run the reply-cli package from the npm registry at runtime. This is expected for a CLI wrapper, but npx will download and execute code from npm on first run — a moderate operational risk that is proportional to the skill's purpose.

Credentials

The only required secret is REPLY_API_KEY (declared as primaryEnv). The script's fallback to /run/secrets/reply_key is consistent with the documented alternatives. No other unrelated credentials or config paths are requested.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent system-wide privileges. It does not modify other skills or agent configuration beyond reading the declared API key fallback. Autonomous invocation is allowed (platform default) and appropriate for this kind of skill.

Assessment

This skill is a thin wrapper around the official reply-cli and looks coherent, but consider the following before installing: (1) npx will download and run the reply-cli package from the public npm registry at runtime — if you need stricter supply-chain control, install a pinned reply-cli version locally or audit the npm package/version you expect to run; (2) keep REPLY_API_KEY secret (use .env, Docker secrets, or a secrets manager) — the script will read /run/secrets/reply_key if present; (3) curl is declared but not used by the included files (harmless but slightly inconsistent); (4) verify you trust the reply-cli package owner before allowing the agent to execute it via npx.

Reply.io CLI (reply-cli)

This skill provides a command-line interface to interact with Reply.io via the official reply-cli tool. It allows you to manage outreach sequences, view statistics, manage contacts, and check connected email accounts directly from your terminal.

Prerequisites & Setup

1. The tool requires Node.js >= 20.
2. It can be run on the fly via npx reply-cli without global installation.
3. You need a Reply.io API Key to authenticate. Get it from Reply.io Settings > API.

Providing Credentials

The skill requires REPLY_API_KEY to be set in the environment. Configure it in your OpenClaw config (openclaw.json) under the agent's env block:

{
  "agents": {
    "defaults": {
      "env": {
        "REPLY_API_KEY": "your-api-key"
      }
    }
  }
}

Alternatively, add it to your ~/.openclaw/.env file, or provide it as a Docker secret at /run/secrets/reply_key.

Quick Reference / Commands

Use npx reply-cli (or just reply if installed globally) to execute commands. All commands support --json for easy machine parsing.

1. Sequences (Campaigns)

# List all sequences and basic stats
npx reply-cli sequences list --json

# Get details and email steps for a specific sequence
npx reply-cli sequences get <id> --json

# Start or Pause a sequence
npx reply-cli sequences start <id>
npx reply-cli sequences pause <id>

# View detailed per-step stats for a sequence
npx reply-cli sequences stats <id> --json

# Top 3 sequences by reply rate
npx reply-cli sequences stats --top

2. Contacts & Enrollment

# Search for a contact by email
npx reply-cli contacts search --email [e-mail] --json

# Create a new contact
npx reply-cli contacts create --email [e-mail] --first-name John --company Acme

# View campaign history and email activity for a contact
npx reply-cli contacts stats [e-mail] --json

# Add contact to a sequence
npx reply-cli sequence-contacts add --contact [e-mail] --sequence 12345

# Create and enroll in one step
npx reply-cli sequence-contacts add-new --contact [e-mail] --first-name Jane --sequence 12345

# Remove from a sequence
npx reply-cli sequence-contacts remove --contact [e-mail] --sequence 12345

3. Accounts & Schedules

# List all connected email accounts
npx reply-cli accounts list --json

# List sending schedules
npx reply-cli schedules list --json

Usage Guidelines for the Agent

1. Always use --json or --pretty when you need to parse the data for the user.
2. Never hardcode or log the API key. Suggest the user store it in their .env file or provide it securely via Docker Secrets.
3. If a user asks for performance or stats, use sequences list and sequences stats <id> to give them a detailed breakdown of opens, replies, bounces, and clicks.