Campaign Tracker

客户开发信追踪与分析 — 自动归档发送记录、匹配客户回复、生成效果分析报告、优化邮件模板

Security Scan

The skill's code and instructions mostly match its stated purpose, but it expects and accesses other skills' files and environment variables (including loading another skill's .env) that are not declared — this mismatch could expose credentials or sensitive config and deserves careful review before use.

Purpose & Capability

The name/description (campaign tracking, reply matching, reporting, template optimization) align with the shipped scripts. However the SKILL.md and scripts expect integration with two other tasks/skills (task-001 imap-smtp-email and task-002 okki-email-sync) and environment variables (EMAIL_SKILL_ROOT, OKKI_VECTOR_SEARCH, OBSIDIAN_VAULT, CAMPAIGN_TRACKER_PROCESSED_FILE) that are not declared in the registry metadata. Requiring access to another skill's filesystem and .env to read IMAP/SMTP data is not obviously proportional to what a user would expect from a drop-in 'campaign tracker' unless that integration is explicit.

Instruction Scope

Runtime instructions and scripts read and write local archives/reports/logs (expected), but they also: require/require() code from EMAIL_SKILL_ROOT (e.g. intent-recognition module), load process.env.EMAIL_SKILL_ROOT + '/.env', and reference an OKKI vector-search path. These instructions tell the agent to read other skill directories and a .env file (likely containing credentials). That broad file access is beyond simple reporting and should be explicitly declared and reviewed.

Install Mechanism

There is no install spec (instruction-only), which lowers installer risk. However the package includes multiple Node.js scripts that will be executed by the user/agent via node; there is no automatic downloader/remote install. The lack of an install step is low risk but means the supplied scripts will run with whatever privileges the agent/user grants.

Credentials

Registry metadata lists no required env vars, but SKILL.md and scripts depend on several environment variables and config paths: EMAIL_SKILL_ROOT (used to require other skill modules and to load a .env), OKKI_VECTOR_SEARCH, OBSIDIAN_VAULT, and CAMPAIGN_TRACKER_PROCESSED_FILE. Loading EMAIL_SKILL_ROOT + '/.env' can expose IMAP/SMTP credentials or API keys from another skill — this is disproportionate unless the user intentionally points EMAIL_SKILL_ROOT to a sanitized location. The skill also writes files to /tmp and local archive/log/report directories (expected) and may update config/tracking-schema.json (template-optimizer).

Persistence & Privilege

The skill is not always-enabled and does not request to auto-install or modify other skills' configurations. It writes its own archives, logs, reports, and may update its own config (tracking-schema.json) which is normal. Note: the platform default allows autonomous invocation; combined with the above undeclared cross-skill access, that increases potential blast radius but 'always:true' is not set here.

What to consider before installing

This skill appears to implement campaign tracking and reporting, but it expects to read files and modules from other skills (e.g. EMAIL_SKILL_ROOT) and even loads a .env from that location — which may contain IMAP/SMTP credentials or other secrets. Before installing or running: 1) Inspect the scripts yourself (archive-sent-records.js, reply-matcher.js, analytics-report.js, template-optimizer.js) — they will be executed by node. 2) Do not point EMAIL_SKILL_ROOT to a live production skill directory that contains credentials unless you have reviewed and sanitized its .env and scripts. 3) Prefer running first in dry-run mode and in an isolated/test environment (or container) so it cannot read unrelated files. 4) Verify what OKKI_VECTOR_SEARCH should point to and whether it invokes remote services or scripts. 5) If you need to use this, explicitly set the required environment variables to trusted, minimal locations and avoid sharing cross-skill secrets. Providing explicit documentation from the author that clarifies which env vars are required and that the skill will not load other skills' secrets would reduce risk and could change this assessment to 'benign'.

campaign-tracker SKILL

客户开发信追踪与分析 — 完整闭环系统

用途

当需要以下操作时使用此 skill：

• 归档开发信发送记录
• 追踪客户回复状态
• 生成开发信效果分析报告（周报/月报）
• 优化开发信模板（A/B测试建议）

前置条件

1. task-001（imap-smtp-email）已配置并能正常发送邮件
2. task-002（okki-email-sync）已配置，OKKI 向量搜索可用
3. Node.js 环境可用

快速开始

# 切换到 skill 目录
cd <path-to-campaign-tracker>
# 或使用环境变量
cd $CAMPAIGN_TRACKER_ROOT

核心命令

归档已发送开发信

node scripts/archive-sent-records.js check --dry-run   # 预览
node scripts/archive-sent-records.js check             # 执行归档

匹配客户回复

node scripts/reply-matcher.js check --dry-run          # 预览
node scripts/reply-matcher.js check                    # 执行匹配
node scripts/reply-matcher.js unmatched                # 查看未匹配

生成分析报告

# 周报
node scripts/analytics-report.js weekly
node scripts/analytics-report.js weekly --obsidian     # 同时输出到 Obsidian

# 月报
node scripts/analytics-report.js monthly
node scripts/analytics-report.js monthly --last-month  # 上个月

模板优化建议

node scripts/template-optimizer.js analyze --dry-run   # 预览
node scripts/template-optimizer.js analyze             # 执行分析
node scripts/template-optimizer.js analyze --obsidian  # 输出到 Obsidian

文件说明

文件	用途
config/tracking-schema.json	数据模型配置（5模块）
scripts/archive-sent-records.js	发送记录归档（512行）
scripts/reply-matcher.js	回复匹配+状态更新（669行）
scripts/analytics-report.js	效果分析报告（542行）
scripts/template-optimizer.js	模板优化+A/B测试（625行）

典型工作流

1. 每次发送开发信后 → 运行 archive-sent-records.js check
2. 每天检查新回复 → 运行 reply-matcher.js check
3. 每周一 → 运行 analytics-report.js weekly --obsidian
4. 每月初 → 运行 analytics-report.js monthly --obsidian
5. 每月优化模板 → 运行 template-optimizer.js analyze --obsidian

数据位置

<campaign-tracker-root>/
├── archive/          # 发送记录归档（JSONL）
├── reply-tracking/   # 回复状态数据（JSONL）
├── reports/          # 分析报告（Markdown+JSON）
└── logs/             # 运行日志

$OBSIDIAN_VAULT/开发信追踪/   # Obsidian 知识库输出

依赖集成

// archive-sent-records.js 读取 smtp.js 发送日志
const emailSkillPath = process.env.EMAIL_SKILL_ROOT || '<path-to-imap-smtp-email>';

// reply-matcher.js 使用 IMAP 收件箱
const imapConfig = require(process.env.EMAIL_SKILL_ROOT + '/.env');

// 客户匹配使用 OKKI 向量搜索
const vectorSearch = process.env.OKKI_VECTOR_SEARCH || '<path-to-okki_vector_search_v3.py>';

注意事项

• 首次运行前确保 archive/、reply-tracking/、reports/、logs/ 目录已存在（脚本会自动创建）
• 所有脚本支持 --dry-run 模式，建议首次运行时使用
• Obsidian 输出需要确认 vault 路径：~/obsidian-vault/
• A/B 测试配置存储在 config/tracking-schema.json 的 ab_testing 模块