Community code plugin. Review compatibility and verification before install.
Latest release: v1.0.0Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The stated purpose is Gmail lead-desk automation, and the artifacts consistently describe Gmail OAuth, unread lead scans, thread summaries, draft replies, sending after confirmation, and label/archive workflows.
Instruction Scope
The embedded skill has useful scope controls, including Gmail-only use, draft-first behavior, tool whitelisting, disabled destructive actions, attachment consent, and confirmations for writes; the manifest wording is broader than ideal but the detailed runtime instructions narrow it.
Install Mechanism
The package is a small native OpenClaw plugin wrapper plus bundled skill files. The executable entrypoint only registers metadata and does not perform install-time actions, background setup, or dependency materialization.
Credentials
It requires AISA_API_KEY and network access to https://api.aisa.one, which is proportionate for an AISA-backed Gmail integration, but email content and mailbox metadata may pass through that external service during requested workflows.
Persistence & Privilege
The skill can create OAuth-linked Gmail connected accounts through AISA and can draft, send, label, and archive messages when instructed. The artifacts do not show hidden persistence, startup hooks, local credential scraping, or unbounded background workers.
Scan Findings in Context
[SQP-1] unexpected: The broad activation wording is a real documentation weakness for a Gmail-capable skill, but the embedded SKILL.md supplies narrower Gmail-only use cases and explicit out-of-scope guidance, so this supports user caution rather than a Review verdict by itself.
[SQP-2] expected: External API use and Gmail content processing are expected for this plugin and are repeatedly disclosed through the AISA_API_KEY and api.aisa.one requirements, though the package would benefit from a more prominent privacy and data-retention notice.
[SQP-1] unexpected: The send trigger phrases are broad, but the workflow requires showing full To/Cc/Bcc/Subject/Body and obtaining another confirmation before sending, which materially reduces the risk of accidental sends.
Assessment
Install only if you are comfortable connecting a Gmail account through AISA and sending mailbox-derived data to api.aisa.one. Use a dedicated or least-privilege account where possible, review every draft before sending, and avoid using it on highly sensitive mailboxes unless the publisher's privacy and retention practices are acceptable.Verification
Tags
Gmail Lead Desk Plugin
ClawHub/OpenClaw native-first plugin wrapper for the packaged AIsa skill.
Runtime Requirements
- Required bins: none
- Required env vars:
AISA_API_KEY - Primary env:
AISA_API_KEY - Network targets:
https://api.aisa.one
What It Ships
- Bundle plugin id:
gmail-lead-desk-plugin - Native manifest:
openclaw.plugin.json - Native entrypoint:
index.js - Embedded skill:
skills/gmail-lead-desk/SKILL.md - Format: native OpenClaw plugin plus Claude-compatible bundle fallback
Why This Format
- Uses the OpenClaw-native manifest path that current plugin docs expect.
- Keeps the packaged skill payload intact under
skills/for ClawHub/OpenClaw skill loading. - Retains
.claude-plugin/plugin.jsonso Claude-compatible marketplace tooling still recognizes the package. - Reuses the already-hardened
clawhub-release/skill payload.
Provenance
- Source repository:
https://github.com/baofeng-tech/agent-skills-io - Embedded skill path:
skills/gmail-lead-desk/SKILL.md - The runtime behavior remains inside the packaged skill payload and its public docs.
Install After Publishing
openclaw plugins install clawhub:gmail-lead-desk-plugin
Publish Locally
clawhub package publish ./plugins/gmail-lead-desk-plugin --dry-run
clawhub package publish ./plugins/gmail-lead-desk-plugin
Notes
- Runtime requirements and guardrails remain inside
skills/gmail-lead-desk/SKILL.md. - If both native and bundle markers exist, OpenClaw prefers the native plugin path.
- This package keeps side effects explicit and relies on the packaged skill's repo-local defaults where applicable.
