MachFive Cold Email

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill is a straightforward MachFive API guide for generating cold-email sequences, but it requires an API key and sends prospect data to MachFive, so users should verify the service and data-sharing rules.

Before installing, confirm you trust the MachFive service and the registry listing, use a dedicated API key if possible, and only submit lead data that you are permitted to share for cold outreach generation.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Users may have less registry context for confirming that this integration is genuinely associated with MachFive.

Why it was flagged

The skill is instruction-only with no code install, but registry provenance is limited for a service integration that asks the user to configure an API key.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the MachFive service URL and account settings directly before creating or storing the API key.

What this means

An agent using this skill can act within the connected MachFive workspace according to the API key's permissions.

Why it was flagged

The skill requires a MachFive bearer API key to list campaigns, submit leads, poll lists, and export generated results.

Skill content
Set `MACHFIVE_API_KEY` in your environment ... Authorization: Bearer {MACHFIVE_API_KEY}
Recommendation

Use a scoped or dedicated API key if MachFive supports it, avoid sharing the key, and revoke it if no longer needed.

What this means

Prospect personal and business contact data leaves the local workspace and is processed by the MachFive service.

Why it was flagged

The documented workflow sends lead contact details and profile/company information to the external MachFive API.

Skill content
POST https://app.machfive.io/api/v1/campaigns/{campaign_id}/generate ... "email": "john@acme.com" ... "linkedin_url": "https://linkedin.com/in/johnsmith"
Recommendation

Only submit lead data you are authorized to share, and review applicable privacy, consent, and outreach-compliance requirements.

What this means

Future generations could be routed to an old or wrong campaign if the stored default is stale or misunderstood.

Why it was flagged

The skill allows persistent reuse of a campaign identifier across future requests.

Skill content
Agents can store a default campaign ID for the workspace if the user provides it
Recommendation

Store a default campaign only after explicit user instruction, and make it easy for the user to review or change it.

What this means

A mistaken campaign or lead batch could create unwanted generated lists and potentially consume service credits before the user notices.

Why it was flagged

Batch generation can process multiple leads after submission without waiting for immediate completion.

Skill content
Generate email sequences for multiple leads ... Returns immediately (202) with `list_id`; processing runs in the background.
Recommendation

Confirm the campaign, lead set, and batch size before submitting batch generation requests.