Email Template

PassAudited by ClawScan on May 1, 2026.

Overview

This skill mostly generates email template text locally, with minor packaging inconsistencies and one unrelated script that logs command history locally.

This appears safe for generating email templates, but use the documented `scripts/emailtpl.sh` path and be aware that the separate `scripts/script.sh` is unrelated to email templates and stores a local history log if run.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI05: Unexpected Code Execution

What this means

Installing or using the skill may involve running a local script, but the documented command is narrow and purpose-aligned.

Why it was flagged

The skill explicitly instructs the agent to run a local Bash script. This is expected for a local template generator and the visible script content is focused on printing templates.

Skill content

Run: `bash scripts/emailtpl.sh <type> [industry] [tone]`

Recommendation

Run only the documented template script unless you have reviewed other included scripts.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

This extra script could confuse users or agents about which functionality belongs to the skill, though the visible behavior is not destructive or credential-seeking.

Why it was flagged

An included executable script describes itself as an AI/prompt-engineering assistant, which does not match the email-template library described in SKILL.md.

Skill content

# email-template - AI and prompt engineering assistant
Commands:
  prompt               Generate prompt
  system               System prompt
  chain                Prompt chain
  template             Prompt templates
  compare              Compare models

Recommendation

Prefer the documented `scripts/emailtpl.sh` workflow; the publisher should remove or clearly document the unrelated helper script.

Low

#ASI06: Memory and Context Poisoning

What this means

If this helper script is used with sensitive text in arguments, that text may remain in a local history file.

Why it was flagged

The helper script creates a persistent local directory and appends command history, including command arguments, to a history log.

Skill content

DATA_DIR="${EMAIL_TEMPLATE_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/email-template}"
mkdir -p "$DATA_DIR"
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Recommendation

Avoid passing secrets or private content as command arguments, and delete `$HOME/.local/share/email-template/history.log` or set `EMAIL_TEMPLATE_DIR` if you need to control where logs are stored.