SendGrid

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent SendGrid integration, but it uses a Maton API key/OAuth connection and can send or modify email-related data, so write actions should be approved carefully.

Install only if you trust Maton as the OAuth/API gateway for your SendGrid account. Keep the MATON_API_KEY private, use the correct connection for the intended account, and carefully review any send, create, update, or delete request before approving it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If approved incorrectly, the agent could send unwanted emails or change SendGrid resources such as contacts, templates, or suppressions.

Why it was flagged

The skill enables high-impact SendGrid write actions, including email sending and account data changes, but it explicitly frames these as requiring user approval.

Skill content
Send transactional and marketing emails, manage contacts, templates, suppressions... All write operations require explicit user approval.
Recommendation

Before approving any write action, verify the SendGrid connection, recipients, sender identity, content, target resource, and intended effect.

What this means

Anyone or any agent action using the key may be able to act through the connected SendGrid account within the granted permissions.

Why it was flagged

The skill depends on a Maton API key and a delegated SendGrid OAuth connection, giving the agent access to the connected SendGrid account through Maton.

Skill content
Authorization: Bearer $MATON_API_KEY ... Maton proxies requests to `api.sendgrid.com` and automatically injects your OAuth token.
Recommendation

Protect the MATON_API_KEY, use the least-privileged SendGrid account/connection available, specify the intended connection when multiple accounts exist, and revoke unused connections.

What this means

Email content and contact/account data may pass through both Maton and SendGrid when the skill is used.

Why it was flagged

SendGrid requests and responses, potentially including email content, contacts, account details, and statistics, flow through the Maton API gateway before reaching SendGrid.

Skill content
Base URL: https://api.maton.ai/sendgrid/{native-api-path} ... Maton proxies requests to `api.sendgrid.com`
Recommendation

Only send necessary data through the gateway, verify that you trust Maton for the connected account, and avoid including unnecessary sensitive information in email/API payloads.