Send transactional and marketing emails via UniOne Email API. Manage email templates, validate email addresses, check delivery statistics, manage suppression...
Security Analysis
high confidenceThe skill's requirements and runtime instructions are consistent with an email-sending integration (it only needs an API key and uses UniOne's HTTP API), though there are minor metadata inconsistencies you should verify before installing.
The skill is clearly an adapter for the UniOne transactional email API and legitimately needs an API key. However, the registry metadata you provided says no required binaries while the README and SKILL.md use curl (and the manifest lists curl and jq). Also the top-level registry metadata listed 'Source: unknown' and 'Homepage: none' while SKILL.md/README include links to unione.io and a GitHub repo—these metadata mismatches should be checked.
SKILL.md's runtime instructions are limited to calling UniOne HTTP endpoints, domain verification steps (DNS records) and email management operations. It only references the declared env var (UNIONE_API_KEY) and does not instruct reading unrelated local files or other credentials. It asks the user to add DNS records at their DNS provider—this is expected for domain verification.
This is an instruction-only skill (no install spec, no code files), which is low risk. The README and manifest expect tools (curl, jq) but there is no install step that fetches code or binaries. Confirm you have curl/jq locally if you plan to use the optional CLI helpers; there are no remote downloads or archives presented by the skill itself.
The only required environment variable is UNIONE_API_KEY (declared as primaryEnv). That is appropriate for an HTTP API integration. No unrelated secrets or multiple credentials are requested.
always: false (the skill is not forced into every agent run). disable-model-invocation is false (agent can call it autonomously), which is the platform default; this is acceptable here because the skill's scope and credential needs are narrow.
Guidance
This skill appears to be what it claims (a UniOne email API adapter) and only needs your UniOne API key. Before installing: (1) Verify the source links in SKILL.md/README (unione.io and the GitHub repo) match an official UniOne release; the registry metadata you were shown earlier was inconsistent. (2) Use a least-privilege/scoped API key (not a production master key) and avoid pasting other secrets. (3) Expect to manually add DNS TXT records at your DNS provider for domain verification—do this yourself and do not share private keys. (4) Confirm curl and jq are available if you plan to use the optional scripts. (5) If you're uncomfortable with autonomous invocation, you can disable or require user confirmation for the skill in your agent settings. If you want higher assurance, ask the publisher for an authoritative repository URL and checksum for the skill package before installing.
Latest Release
v0.1.2
unione-api-skill v0.1.2 - Documentation and metadata updates only. - README.md, SKILL.md, and manifest.json modified with no functional/API changes. - No code or API behavior changes in this release.
Popular Skills
Published by @unione-repo on ClawHub
