OpenClaw skill: email inbox triage
SaferSkills independently audited inbox-triage (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Triage the user's Gmail primary inbox. If the user has multiple accounts with forwarding, the primary account is the single source of truth. Skip promotions, social, updates, forums.
When replying to emails: check the original sender/recipient. If the email was sent to a secondary/edu account, reply FROM that address. If sent to the primary account, reply via gog. Check MEMORY.md for account details.
❓ QUESTION — Need user input to proceed. Also use for ambiguous emails where the subject alone isn't enough to decide (event invites, lectures, workshops). Include enough detail: who, what, when, where.
⚡ ACTION — Has an actionable task you can automate (draft reply, update calendar, schedule meeting). Present what you plan to do.
📌 KEEP — Important or complex; user handles themselves. Will become a reminder once approved.
📥 ARCHIVE — Irrelevant, unimportant, or finished. Includes: verification codes, resolved threads, generic welcomes, autopay bills (note amount + date), expired events.
❓ QUESTION
Guest Lecture (4:02 PM) — "Topic Title" by Speaker Name (Organization), Wed Mar 11 5 PM, Venue. ✅ No conflict. RSVP by Mar 9.
⚡ ACTION
Project / Contact Name (7:41 AM) — Meet Mon 2/23 1:30pm? ⚠️ Conflict: other event at 1:30–2:00.
📌 KEEP
Tax Resources / Admin Office (4:03 PM) — Access code for tax filing
📥 ARCHIVE
Internet bill ready (1:48 PM) — Auto pay $40 on 3/6, no action neededGo section by section: ARCHIVE → KEEP → QUESTION → ACTION.
Note: Telegram reactions only arrive with the next user message. After sending batched items, tell user to react then send any message.
gog gmail label modify <id> --remove INBOX).#claude in notes fieldTo set a real clickable URL on a reminder (not just in notes):
cat << 'EOF' | swift -
import EventKit
import Foundation
let store = EKEventStore()
let semaphore = DispatchSemaphore(value: 0)
store.requestFullAccessToReminders { granted, error in
guard granted else { semaphore.signal(); return }
let predicate = store.predicateForReminders(in: nil)
store.fetchReminders(matching: predicate) { reminders in
guard let reminders = reminders else { semaphore.signal(); return }
for r in reminders where r.title == "REMINDER_TITLE" {
r.url = URL(string: "REMINDER_URL")
do { try store.save(r, commit: true); print("URL set") }
catch { print("Error: \(error)") }
}
semaphore.signal()
}
}
semaphore.wait()
EOFReport what was done at the end. Brief summary of actions taken.
Update the last check timestamp.
Check MEMORY.md for user-specific email categorization preferences (which senders to auto-archive, which to flag, etc.).
drafts/<id>.json → show draft + "✉️ Send" button → wait for button press → only then execute sendcallback_data: send_draft:<token> — the callback_data: prefix proves it came from a button, not typed textcallback_data: prefix AND (2) token matches a valid draft file~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.