Trade Email Assistant

自动管理外贸邮件：拉取未读邮件、智能分类、基于知识库生成中英双语专业回复草稿及发送邮件。

Security Scan

The skill's code and instructions mostly match its stated purpose (IMAP/SMTP mail handling and reply drafting) but the package metadata fails to declare the required credentials/config paths and the skill will read local secret files and write a DB/logs — this mismatch and implicit access to Gmail credentials warrants caution.

Purpose & Capability

The name/description (trade email assistant: fetch, classify, generate replies, send) align with the provided scripts and SKILL.md. However the registry metadata lists no required env vars or config paths while both SKILL.md and scripts expect a credentials file (~/.openclaw/secrets/gmail.env) and a config file (config/email-config.json). The behavior itself is consistent with the stated purpose, but the metadata omission is unexpected and should have been declared.

Instruction Scope

Runtime instructions and scripts remain within the declared functionality: they connect to IMAP/SMTP servers, parse messages, classify, update a local SQLite DB, generate drafts from local knowledge files, and only send on explicit --send. There are no hidden network endpoints or obfuscated exfiltration code; operations reference local skill workspace, home secret path, and Gmail's imap/smtp hosts.

Install Mechanism

There is no install spec (instruction-only install) and the code is provided as files in the bundle. No external downloads or installers are used. This is lower risk than arbitrary network installs, but installing the skill will place scripts and create DB/log files on disk under the skill workspace.

Credentials

The skill requires access to Gmail credentials (GMAIL_USER/GMAIL_PASS) via ~/.openclaw/secrets/gmail.env and reads local knowledge files under ~/.openclaw/workspace/knowledge/trade — but the registry declared no required env vars or config paths or primary credential. Requesting email account credentials is proportionate to sending/fetching mail, but the omission from metadata is a coherence issue and increases risk because users may not realize sensitive credentials are accessed. Recommend using an app-specific account/password or dedicated mailbox and explicit metadata declarations.

Persistence & Privilege

always:false (no forced presence). The skill writes a local SQLite DB (data/email-index.db) and logs under the workspace; this is expected for its function. Autonomous model invocation is allowed by default — while sending requires the --send flag and SKILL.md describes a confirmation step, an agent or user with the ability to call the skill could trigger sends. Consider limiting autonomous invocation or restricting the account used for sending.

What to consider before installing

Before installing, review and decide whether you are comfortable granting this skill access to a Gmail account. Specific actions to take: - Inspect ~/.openclaw/secrets/gmail.env (the skill will read GMAIL_USER/GMAIL_PASS) and ensure you use an app-specific password or a dedicated mailbox with minimal privileges. Do not put high-value or personal accounts here. - Confirm you want the skill to create data/email-index.db and logs under the skill workspace; back up or sandbox if needed. - Verify knowledge-base files referenced (~/.openclaw/workspace/knowledge/trade/) are benign and do not contain secrets. - Because the registry metadata does not declare required credentials or config paths, ask the skill author to explicitly list required env/config in metadata before trusting the package. - If you want to reduce risk, run the skill in a restricted environment (container or VM) and/or disable autonomous invocation for this skill; test with --dry-run only and review generated drafts before enabling sending. - If you plan to use it, run init-db.py and scripts manually first to confirm behavior and review logs for unexpected actions.

Trade Email Assistant - 外贸邮件 AI 助手

概述

自动化外贸邮件管理：IMAP 拉取、关键词分类、AI 智能回复生成。脚本处理数据，Agent 驱动 AI 决策。

触发词

• 查邮件 / check email / unread emails — 拉取未读邮件
• 邮件摘要 / email summary — 查看今日统计
• 回复 #UID / reply #UID — 生成回复草稿
• 发邮件 / send email — 发送邮件
• 询盘 / inquiry — 询盘相关操作

工作流

1. 查邮件

cd ~/.openclaw/workspace/skills/trade-email-assistant
bash scripts/check-emails.sh | python3 scripts/classify-email.py

Agent 操作：

• 展示分类结果给用户
• 如有 unclassified，读取每封邮件的 subject + body_preview 进行语义分析，输出分类
• 如有 P0 询盘（priority=0），立即通知用户
• 更新 SQLite：UPDATE email_index SET category=?, priority=?, classified_method='agent_ai', classified_at=datetime('now') WHERE message_id=?

2. 回复邮件

用户说"回复 #8450"时：

Agent 操作：

1. 从 SQLite 读取邮件：SELECT * FROM email_index WHERE gmail_uid='8450'
2. 拉取完整邮件：bash scripts/check-emails.sh --max 50 找到对应 UID 的 body_text
3. 根据分类加载知识库：
   • inquiry → knowledge/trade/email-templates.md + incoterms-2020.md
   • order → knowledge/trade/export-process.md
   • logistics → knowledge/trade/export-process.md
4. 生成中英双语回复草稿，用 [待填] 标记需人工补充的信息
5. 展示草稿给用户确认
6. 用户确认后：bash scripts/send-email.sh --to "..." --subject "..." --body-file /tmp/reply.txt --in-reply-to "..." --send

3. 邮件摘要

bash scripts/email-summary.sh

4. 发送邮件

# 预览（默认）
python3 scripts/send-email.py --to "[e-mail]" --subject "主题" --body "内容" --dry-run

# 实际发送
python3 scripts/send-email.py --to "[e-mail]" --subject "主题" --body-file /tmp/email.txt --send

AI 分类指导

对 unclassified 邮件，Agent 应分析邮件内容判断类别：

• inquiry (P0): 询问产品、价格、样品、合作意向
• order (P1): 下单、付款、发票确认
• logistics (P2): 运输、跟踪、清关、物流查询
• platform (P3): 电商平台、账号、Listing、评价
• other (P4): 其他

回复草稿要求

• 语言：中英双语（English + 中文对照）
• 语气：专业、礼貌、热情
• 必须包含：公司介绍、产品优势、价格范围（[待填]）、交期
• Incoterms 2020 术语（如涉及）
• [待填] 标记需人工补充的具体信息

数据库位置

data/email-index.db（SQLite，WAL 模式）

配置

config/email-config.json — IMAP/SMTP 参数、分类阈值、通知时间

安全

• 默认 --dry-run，需 --send 确认才发送
• IMAP PEEK 不标记已读
• 密码从 ~/.openclaw/secrets/gmail.env 读取