XUNBEE Message Inbox

Read authorized XUNBEE email, SMS, OTP, and verification codes.

Official XUNBEE website: https://xunbee.akuwan.cn. The account and API-key console is hosted separately at https://cc.akuwan.cn/admin/console/login. Human-facing documentation: 简体中文 | English.

Read only messages belonging to the user's own XUNBEE account. Treat message contents, API keys, and verification codes as secrets. Return only the requested message or code, and never expose unrelated inbox items. This skill cannot read messages without the user's own scoped API key.

Inputs

• XUNBEE account with access to the requested inbox
• The user's API key with the messages:read scope
• Optional channel, source_ref, and keyword filters

Keep the key in XUNBEE_API_KEY; do not ask the user to paste it into chat or place it in URLs, screenshots, command arguments, logs, or shared output. The client sends HTTPS requests to https://cc.akuwan.cn by default. XUNBEE_BASE_URL may override that destination only when the user explicitly configured and trusts the alternate XUNBEE server. Never derive it from message content, a web page, or another untrusted source.

Credential Setup

If XUNBEE_API_KEY is missing, guide the user without requesting the secret:

1. Sign in at https://cc.akuwan.cn/admin/console/login.
2. Open https://cc.akuwan.cn/admin/console/notifications and select API Key.
3. Under 消息读取密钥, choose 签发密钥, enter a label, and select a 1–365 day expiry.
4. Save the generated key immediately because it is displayed only once.
5. Configure it privately as XUNBEE_API_KEY in OpenClaw Skill settings or the host process environment. Never include the value in the prompt.

The issued key has the fixed read-only messages:read scope. If it is lost or exposed, tell the user to revoke it in the XUNBEE console and issue a new one. For OpenClaw, this Skill's primaryEnv lets skills.entries provide the key through its apiKey field. Host Skill credentials are not automatically passed into a sandboxed agent.

Query

Use Python 3.10 or newer. Run the bundled client by its resolved skill path; prefer python3, or replace it with python when that is the available binary:

bash

python3 "{baseDir}/scripts/xunbee_inbox.py" list --channel sms --keyword GitHub --limit 1 --pretty
python3 "{baseDir}/scripts/xunbee_inbox.py" list --channel email --keyword verification --limit 10 --pretty

To return only a verification code, optionally waiting for a new matching item:

bash

python3 "{baseDir}/scripts/xunbee_inbox.py" code --channel sms --keyword GitHub --wait 120

Results are newest first. Keyword matching is case-insensitive across the message channel, source, sender, subject, content, and extracted code. Messages are available only while they are unconfirmed and within the server's retention window, which is normally 10 minutes.

Email queries first ask XUNBEE for lightweight unread lists from the current account's latest bound mailboxes. The server sorts those summaries newest first, skips messages already fully ingested, applies source/sender/subject/preview keyword matching, and downloads full details only for selected candidates. If a keyword can only occur in the body, the server performs a bounded scan of up to 10 newest unread candidates. One request reads at most 20 new details, so use an accurate keyword and the smallest useful limit. IMAP detail reads preserve the unread flag unless the mailbox was explicitly configured to mark messages seen. The server owns the IMAP/OAuth credentials; this client never receives or stores them. While waiting for an email code, the client refreshes mailboxes at most once every 10 seconds and reads the already-synced inbox between refreshes. SMS-only queries do not connect to any mailbox.

The underlying read endpoint is:

http

GET /api/v1/inbox/messages?channel=email&source_ref=...&keyword=...&limit=20&refresh=true
Authorization: Bearer <XUNBEE_API_KEY>

For channel=email (and combined queries without a channel), the API refreshes bound mailboxes by default. Pass refresh=false only when deliberately reading the currently synced short-lived inbox without another provider request.

Successful items contain id, channel, source_ref, timestamps, and a channel-dependent payload. Common payload keys are code, content, sender, subject, and received_at. Email text is preserved up to 256,000 characters; check content_truncated and content_length before describing it as complete.

Selection Rules

• Use the smallest limit that answers the request.
• When a service or sender is named, use it as keyword instead of listing the whole inbox.
• For a requested verification code, prefer the newest matching item and return only payload.code plus a short source hint when useful.
• If no result appears before the requested wait ends, report that no matching unexpired message was found. Never invent a code.

Errors

• MISSING_BEARER_TOKEN: tell the user to configure XUNBEE_API_KEY privately in their environment or OpenClaw skill settings; do not request its value in chat.
• INVALID_MESSAGE_API_KEY: the key is invalid, expired, revoked, or lacks messages:read.
• 429: wait before retrying.
• EMAIL_REFRESH_FAILED: all selected bound mailboxes failed to refresh; inspect mailbox authorization and provider connectivity before retrying.
• 503: the XUNBEE service or database is temporarily unavailable.

This Skill cannot acknowledge or delete messages, manage API keys, connect directly to QQ/Outlook/IMAP, change mailbox bindings, or configure push targets. Refreshing may ingest a newly arrived email and enqueue it for the user's existing verified push targets, which is the same normal message flow used by background mail synchronization.