UniProfit Mail Assistant

Send emails through the UniProfit OpenClaw-compatible API with a user-created `mail_send` API key. Use when Codex or OpenClaw needs to deliver an already-app...

Security Scan

The skill is internally consistent: it only asks for a UniProfit base URL and a mail_send API key, requires python, and its scripts and instructions perform only the described UniProfit credential check, account list, and send operations.

Purpose & Capability

Name/description, declared env vars (UNIPROFIT_API_BASE_URL, UNIPROFIT_MAIL_SEND_KEY), required binary (python), SKILL.md protocol, and the two scripts all align with a mail-sending integration for UniProfit. Nothing requested appears unrelated to the stated purpose.

Instruction Scope

SKILL.md prescribes only three UniProfit endpoints (/openclaw/credential/me, /openclaw/mail/account/list, /openclaw/mail/send). The execution checklist and input requirements limit actions to listing accounts, selecting a sender, validating fields, and posting the send request. The scripts only read the declared env vars and call those endpoints; they do not access other system files or unrelated env vars.

Install Mechanism

No install spec (instruction-only) and only requires an existing python binary. No downloads or archive extraction are performed, and included scripts are small and readable.

Credentials

Only two environment variables are required and both are directly relevant to the mail-sending purpose. The skill does not request additional credentials or configuration paths. The primary credential in agents/openai.yaml is the mail send key, which matches purpose.

Persistence & Privilege

always is false and the skill does not request persistent system-wide changes or modify other skills. It can be invoked autonomously (platform default), which is expected for a delivery skill; nothing in the package attempts to escalate privilege or persist beyond its intended scope.

Assessment

This package appears coherent and implements only the declared UniProfit mail API calls. Before installing: 1) Verify UNIPROFIT_API_BASE_URL points to a trusted UniProfit endpoint you control (a malicious base URL could receive the API key and request bodies). 2) Use a scoped mail_send key with minimal privileges and rotate it if you suspect exposure. 3) Confirm recipients and final body are approved before sending (the skill will deliver real email). 4) If you want extra assurance, review the two included Python scripts and the SKILL.md; they are short and straightforward. If you do not trust the provided base URL or key, do not set the environment variables.

Use this skill to send emails through UniProfit.

Quick Start

Required environment variables:

• UNIPROFIT_API_BASE_URL
• UNIPROFIT_MAIL_SEND_KEY

Credential format:

X-UniProfit-Key: {UNIPROFIT_MAIL_SEND_KEY}

Read only what you need:

• Read references/api.md for request and response formats.
• Read references/mail-constraints.md for sending prerequisites and safety checks.
• Read references/error-handling.md when the API returns a send failure.

Protocol Contract

For runtime execution, follow this protocol exactly.

Use only these runtime endpoints:

• GET {UNIPROFIT_API_BASE_URL}/openclaw/credential/me
• GET {UNIPROFIT_API_BASE_URL}/openclaw/mail/account/list
• POST {UNIPROFIT_API_BASE_URL}/openclaw/mail/send

Execution checklist:

• send authentication with X-UniProfit-Key
• send mail requests as POST
• send mail requests with a JSON body
• keep account_id, to_email, subject, and body in the request body

Do not replace this skill with generic mail-delivery endpoints.

Canonical runtime pattern:

1. validate the credential if needed with GET /openclaw/credential/me
2. fetch available sender accounts with GET /openclaw/mail/account/list
3. ask the user to choose sender email from that list
4. map selected email to account_id and execute send with POST /openclaw/mail/send
5. report the confirmed send status

Run scripts/check_credential.py if the credential may be missing or invalid.

Use This Skill When

• the user clearly wants actual delivery
• recipient, subject, and final body content are already known
• the send should go through a bound UniProfit mail account

Do not use this skill for:

• trade lead search
• email generation or rewriting
• sending when key facts are still missing

Input Requirements

Require all of:

• selected sender email (from account list)
• recipient email
• subject
• final email body

Then map the selected sender email to its account_id before calling the send endpoint. If any send-critical field is missing, stop and ask for it rather than sending.

Execution Flow

1. Confirm the user wants actual delivery.
2. Fetch available sender accounts via GET /openclaw/mail/account/list.
3. Ask the user to select one sender email from the returned list.
4. Ensure send-critical fields are present.
5. Run scripts/send_mail.py, or make the same protocol call to POST /openclaw/mail/send with X-UniProfit-Key and a JSON body.
6. Report send result clearly.

Never imply an email was sent unless the API confirms success.

Output Style

Return:

• recipient
• send status
• record id or message id if present

Keep the explanation short and practical.