Skill: sergiorico1/thrd-skill (version 1.2.7)

--- name: thrd description: "Provision a dedicated inbox for your AI agent and manage email safely via thrd.email. Includes instant onboarding, inbound polling, reply/send (idempotent + policy-gated), Proof of Reasoning for cold outbound, Human Claiming for verification, and trust/delivery tracking. Does not persist API keys to disk." metadata: { "openclaw": { "emoji": "📧", "requires": { "bins": ["python3"], "env": ["THRD_API_KEY"] }, "install": [ { "id": "pip", "kind": "exec", "command": "pip install -r requirements.txt", "label": "Install Python dependencies", }, ], }, } --- # Thrd Email Skill This skill helps you create and operate an isolated inbox for an AI agent using [thrd.email](https://thrd.email), without connecting your personal inbox. Safety by default: don't connect your primary inbox to an agent; use a dedicated agent inbox. ## Workflows ### Sync API Contract (Recommended Before Tool Use) To avoid stale assumptions, refresh the OpenAPI contract and read `info.version`: ```bash python3 scripts/openapi_sync.py python3 scripts/openapi_sync.py --print-version ``` This uses HTTP cache validators (`ETag`/`Last-Modified`) and only re-downloads when changed. ### Provision a New Email Account To create a new email account, run the onboarding script: ```bash python3 scripts/onboard.py --agent-name "My Agent" [--tenant-name "My Company"] ``` This prints a JSON payload to stdout that includes `api_key` and the new inbox address. Treat `api_key` as a secret. Security note: **Do not write your API key to disk.** Store it in your runtime's secret manager and set `THRD_API_KEY` as an environment variable. (The rest of the tools require `THRD_API_KEY`; onboarding does not.) ### Upgrade Plan (Billing) To start paid billing for your current tenant, use the checkout script: ```bash python3 scripts/checkout.py <plan_name> ``` Plans: - `sandbox` -> Sandbox Starter (9 EUR/month, raises Tier 1 monthly limit from 100 to 2,000 emails) - `limited` -> Tier 2 - `verified` -> Tier 3 Forward the resulting Stripe URL to your human owner for payment. ### Human Claiming (Verification) Tier 3 (Verified Outbound) requires a responsible human linked via X. - Start the flow: `POST /v1/claim/x/start` - Forward the `claim_url` to your human owner. - Check status: `GET /v1/claim/x/status` ### Proof of Reasoning (PoR) Cold outbound (Tier 3) may require a reasoning challenge to prevent spam. - If you receive a `428 por_required` error, solve the logical challenge provided in the response. - Re-send the request with `por_token` and `por_answer`. ### Manage Emails and Track Delivery For detailed API usage (polling, sending, replying, trust scores, and checking delivery status), see [references/api.md](references/api.md). Note: replies use reply-all behavior by default: they preserve historical CC and keep recipients from the latest inbound `To` line so participants are not dropped. Tier2+ may add CC via `cc[]`. In Tier1, `cc[]` may only contain addresses already present in that thread's CC history. Security note: when Prompt Shield marks an inbound email as high-risk, Tier2/3 flows may require creating a short-lived `security_ack_token` (`POST /v1/security/ack`) before `reply`/`send`. Quota note: use `GET /v1/usage` to monitor monthly usage (`used`, `remaining`, `state`, `reset_at`) and avoid hitting hard limits mid-run. ### Wake-Up Strategy (Recommended) Many LLM runtimes do not reliably maintain background polling. Use wake webhooks when possible: - Configure webhook: `PUT /v1/wake/webhook` - Read status: `GET /v1/wake/webhook` - Disable webhook: `DELETE /v1/wake/webhook` THRD sends signed `inbox.pending` pings, then your runtime should immediately pull with `GET /v1/events` and ACK. Fallback when webhooks are not available: ```bash python3 scripts/poll_daemon.py --cursor-file .thrd_cursor --on-events "echo inbound-ready" ``` This keeps pull-based delivery alive without requiring a public webhook endpoint. Security note: `--on-events` runs in safe argv mode (no shell). Shell operators like `;`, `&&`, pipes, or redirects are not supported. ## Tools - `scripts/onboard.py`: Instant provisioning of a new email inbox. - `scripts/checkout.py`: Generate a Stripe Checkout URL for upgrades. - `scripts/openapi_sync.py`: Refresh/cache latest OpenAPI and read current `info.version`. - `scripts/poll_daemon.py`: Fallback long-poll daemon for runtimes without wake webhook support.

path: requirements.txt
content: requests>=2.31.0


path: scripts/checkout.py
content: #!/usr/bin/env python3
import requests
import json
import sys
import os

# Configuration from memory/environment
[REDACTED_SECRET]"THRD_API_KEY")

def create_checkout(plan):
    if not [REDACTED_SECRET]"ok": False, "error": "THRD_API_KEY environment variable not set."}))
        return

    url = "https://api.thrd.email/v1/billing/checkout/self"
    headers = {
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"
    }
    payload = {"plan": plan}
    
    try:
        response = requests.post(url, json=payload, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
        print(json.dumps(data, indent=2))
    except Exception as e:
        print(json.dumps({"ok": False, "error": str(e)}))
        sys.exit(1)

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 checkout.py <sandbox|limited|verified>")
        sys.exit(1)
    
    plan_name = sys.argv[1].lower()
    if plan_name not in {"sandbox", "limited", "verified"}:
        print(json.dumps({"ok": False, "error": "invalid_plan", "allowed": ["sandbox", "limited", "verified"]}))
        sys.exit(1)
    create_checkout(plan_name)


path: _meta.json
content: ownerId: kn76gbd4kg8sg18vvnhszj2hjh814xx9
slug: thrd
version: 1.2.6
publishedAt: 1771167960430

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)