Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent email-marketing tool, but it enables bulk sending and recipient tracking without clear consent, privacy, or campaign-safety guardrails.
Before installing, confirm this will only be used with properly obtained recipient lists, clear sender identity, working unsubscribe handling, and any legally required notices or consent for tracking opens, clicks, and conversions. Treat scheduled sends and automatic follow-ups as sensitive campaign actions that should require explicit configuration and easy cancellation.
The skill explicitly supports bulk email sending to customer lists and campaign automation, but provides no safeguards or warnings about consent, lawful basis, recipient expectations, or anti-spam compliance. In this context, the omission increases the risk that users will use the tool for unsolicited marketing, privacy-invasive targeting, or sending to improperly obtained contact lists.
The skill advertises open-rate, click-rate, and conversion tracking without informing users that these features involve collecting behavioral data and monitoring recipient interactions. That omission is risky because tracking pixels and link instrumentation can process personal data and create privacy/compliance exposure if used without notice, consent, or appropriate configuration.
The display name and description are written entirely in Chinese, and the manifest provides no indication that the skill is region-specific or that users can choose another language. This creates a natural-language locale constraint that may violate policy when no user opt-in or justification is documented.
A skill that forces a specific language without offering user choice can violate language or locale policy. This file presents all operational instructions in Chinese and does not state that the skill is region-specific or provide an opt-in or alternative language.
No suspicious patterns detected.
