A working Email Daily Summary integration with OpenClaw is built as an explicit skill: you implement a small HTTP service (the skill runtime) that knows how to authenticate to the user’s mail provider (OAuth or API key), fetch messages via that provider’s REST API, create a compact summary (local heuristic or call an external summarizer), and deliver the summary by email or webhook. Install that skill through ClawHub, supply the skill’s callback/webhook URL and environment secrets, manage user OAuth flows so you persist refresh tokens in a secure secret store outside the agent, and schedule a daily trigger from an external scheduler or a reliable jobs system that calls the skill. Ensure tokens/scopes are correct, long-running state and scheduling live outside the agent runtime, and use logs + API response checks to debug failures.

Overview — responsibilities and constraints

• What the OpenClaw skill should do: accept an invocation (HTTP/webhook), use stored credentials to fetch recent emails via provider REST API, produce a short summary, and send or return the summary.
• What must live outside the agent: persistent secret storage for refresh tokens (database or vault), a scheduler or cron job for daily triggers, and any long-running processing or retry queue for reliability. The agent runtime should be short-lived and stateless.
• Authentication: perform OAuth flows or API-key provisioning explicitly. Store refresh tokens securely and use them to obtain access tokens at runtime.
• Observability: emit logs and record API response bodies/status codes. When failing, inspect provider error payloads, token expiry/scopes, and invocation records in ClawHub.

High-level steps

• Design the skill endpoint that will be invoked to produce a daily summary (HTTP POST webhook).
• Implement OAuth for the mail provider (user consent, exchange code, persist refresh token).
• Implement REST calls to list and fetch messages, respecting provider rate limits and scopes.
• Create a summarization step (simple extractive algorithm or call an external summarizer API).
• Deliver the summary (send email via SMTP/SendGrid or return it to the caller).
• Install and configure the skill in ClawHub with the skill’s webhook URL and environment variables (client ID/secret, API keys stored securely).
• Schedule daily invocations externally (cron, cloud scheduler) to call your skill’s endpoint, or accept external triggers.
• Instrument logs and error handling to catch auth problems, 4xx/5xx API errors, and timeouts.

Authentication and tokens

• OAuth flow: Redirect user to the provider’s authorization URL with correct scopes (e.g., read-only mail scopes). Exchange the authorization code for an access token and a refresh token. Persist the refresh token in a secure store (DB, secrets manager).
• At runtime: Use the refresh token to obtain a short-lived access token before calling the mail API. Verify scopes and handle token refresh errors (revoked tokens, consent changes).
• Secrets handling: Keep client_id, client_secret, and provider API keys outside the agent image—store them in the environment or a secrets store and configure them in ClawHub when you install the skill.

Fetching mail — REST examples and considerations

• Use the provider’s official REST endpoints. For Gmail (example only) you refresh a token at https://oauth2.googleapis.com/token, list messages at https://gmail.googleapis.com/gmail/v1/users/me/messages, and fetch message content at https://gmail.googleapis.com/gmail/v1/users/me/messages/{id}?format=full.
• Fetch only what you need (e.g., messages from the last 24 hours). Use query parameters (provider query language) to reduce bandwidth.
• Respect rate limits: back off on 429 responses and implement retries with exponential backoff for transient errors.

Summarization options

• Simple extractive: take message subjects, the first sentence of each message, or a small concatenation with basic deduplication and truncation. This is fast and offline.
• Statistical/ML summarizer or LLM: call an external summarization API (OpenAI or another LLM provider) if you want higher-quality prose. Treat LLM use as an external API—manage tokens, costs, and data privacy explicitly.
• Be explicit about PII and consent: if summaries include personal information, ensure the user’s consent and follow provider terms.

Delivery methods

• Send via SMTP or transactional email provider (e.g., SendGrid, Mailgun): the skill composes and posts the email.
• Return to caller: if a downstream system collects the summary, return JSON and let that system deliver it.
• Store summary: if you need history, store a copy in an external database and keep only metadata in the agent runtime.

Scheduling

• Do not rely on the agent runtime for guaranteed daily timing. Use an external scheduler (cron, cloud scheduler, or a job queue) to make an HTTP call to the skill endpoint every day.
• For multi-tenant setups, schedule per-user jobs or have a single job that iterates users but runs outside the agent, with concurrency limits to avoid hitting provider rate limits.

Error handling and debugging

• Log inbound invocation metadata, token refresh success/failure, API responses, and summary output.
• On failure, check: stored refresh token validity, OAuth scopes, provider error payloads, and network timeouts.
• Keep the skill’s logs accessible through whatever logging the runtime provides and be prepared to replay failed invocations manually.

Security considerations

• Use least-privilege scopes for the mail API.
• Encrypt refresh tokens at rest or keep them in a managed secrets system.
• Validate webhooks/requests to the skill (HMAC or signed tokens) so only authorized callers can trigger daily summaries.
• Limit summary content length and redact sensitive fields if the user requests it.

Concrete Node.js example (stateless skill invocation)

• The example below shows an HTTP endpoint that:
  • uses a stored refresh token to obtain an access token,
  • lists recent messages,
  • fetches a few messages and produces a simple extractive summary,
  • sends the summary via SendGrid.
• Fill in your own client ID/secret, refresh token, and SendGrid API key in secure environment variables before running.

// Simple express service: POST /run-summary triggers the work
// Requires environment variables: MAIL_CLIENT_ID, MAIL_CLIENT_SECRET, MAIL_REFRESH_TOKEN, SENDGRID_API_KEY, FROM_EMAIL, TO_EMAIL

const express = require('express');
const fetch = require('node-fetch');

const app = express();
app.use(express.json());

const {
  MAIL_CLIENT_ID,
  MAIL_CLIENT_SECRET,
  MAIL_REFRESH_TOKEN,
  SENDGRID_API_KEY,
  FROM_EMAIL,
  TO_EMAIL
} = process.env;

async function refreshAccessToken() {
  // <b>//</b> OAuth2 token refresh for Google-style token endpoint
  const res = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      client_id: MAIL_CLIENT_ID,
      client_secret: MAIL_CLIENT_SECRET,
      refresh_token: MAIL_REFRESH_TOKEN,
      grant_type: 'refresh_token'
    })
  });
  if (!res.ok) throw new Error(`token refresh failed ${res.status}`);
  return res.json(); // { access_token, expires_in, scope, token_type, ... }
}

async function listMessageIds(accessToken, query = 'newer_than:1d') {
  // <b>//</b> list message IDs (Gmail example)
  const url = `https://gmail.googleapis.com/gmail/v1/users/me/messages?q=${encodeURIComponent(query)}&maxResults=10`;
  const res = await fetch(url, { headers: { Authorization: `Bearer ${accessToken}` } });
  if (!res.ok) throw new Error(`list messages failed ${res.status}`);
  const body = await res.json();
  return (body.messages || []).map(m => m.id);
}

async function getMessageRaw(accessToken, id) {
  // <b>//</b> fetch single message with minimal payload
  const url = `https://gmail.googleapis.com/gmail/v1/users/me/messages/${id}?format=full`;
  const res = await fetch(url, { headers: { Authorization: `Bearer ${accessToken}` } });
  if (!res.ok) throw new Error(`get message failed ${res.status}`);
  return res.json();
}

function extractSimpleSummary(messages) {
  // <b>//</b> Very simple extractive summary: subject + first sentence of snippet
  const lines = messages.map(m => {
    const subjHeader = (m.payload && m.payload.headers || []).find(h => h.name === 'Subject');
    const subject = subjHeader ? subjHeader.value : '(no subject)';
    const snippet = m.snippet || '';
    const firstSentence = snippet.split(/(?<=[.!?])\s/)[0];
    return `- ${subject}: ${firstSentence}`;
  });
  return lines.join('\n');
}

async function sendEmail(summary) {
  // <b>//</b> Send using SendGrid v3 API
  const res = await fetch('https://api.sendgrid.com/v3/mail/send', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${SENDGRID_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      personalizations: [{ to: [{ email: TO_EMAIL }], subject: 'Daily Email Summary' }],
      from: { email: FROM_EMAIL },
      content: [{ type: 'text/plain', value: summary }]
    })
  });
  if (!res.ok) {
    const txt = await res.text();
    throw new Error(`send email failed ${res.status} - ${txt}`);
  }
}

app.post('/run-summary', async (req, res) => {
  try {
    // <b>//</b> refresh token -> access token
    const token = await refreshAccessToken();
    const accessToken = token.access_token;

    // <b>//</b> list message ids and fetch a few messages
    const ids = await listMessageIds(accessToken, 'newer_than:1d');
    const fetches = ids.slice(0, 5).map(id => getMessageRaw(accessToken, id));
    const messages = await Promise.all(fetches);

    // <b>//</b> summarize and send
    const summary = extractSimpleSummary(messages);
    await sendEmail(summary);

    res.json({ ok: true, summaryCount: messages.length });
  } catch (err) {
    console.error('run-summary error', err);
    res.status(500).json({ ok: false, error: String(err) });
  }
});

const port = process.env.PORT || 3000;
app.listen(port, () => console.log('skill listening', port));

Testing and validation

• Run the OAuth flow for a test user and verify the refresh token is stored correctly.
• Invoke the skill endpoint manually with the same request the scheduler will send and confirm logs show token refresh and successful API calls.
• Force common failure modes: expired refresh token, revoked consent, or insufficient scope, and verify error messages and remediation steps are clear.

Operational checklist before production

• Verify the mail API scopes are minimal and approved by your compliance team.
• Use secure secret storage for client secrets and refresh tokens.
• Make sure scheduled invocations are external to the agent runtime.
• Monitor for rate limits and add exponential backoff/retries.
• Document how to revoke access and how to rotate client secrets.