Back to skill

Security audit

MailerLite

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed MailerLite integration, but users should treat sends and deletes as real account-changing actions.

Install only if you trust Maton to proxy your MailerLite account. Keep MATON_API_KEY private, choose the correct Maton connection when multiple accounts exist, and require explicit confirmation before any send, delete, webhook, automation, or subscriber-change action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents a GDPR 'forget subscriber' endpoint that irreversibly deletes subscriber data, but it does not add a clear warning that this action is permanent and should require explicit confirmation of the exact target. In an agent context, destructive privacy operations are higher risk because a mistaken identifier or ambiguous user request can cause unrecoverable data loss.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The schedule endpoint example includes 'delivery: instant' without a prominent warning that it can immediately send mail to real recipients. In an agent-driven workflow, this creates a meaningful risk of accidental mass email transmission, reputational damage, and compliance issues if the user intent is not re-confirmed.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Subscriber

```bash
DELETE /mailerlite/api/subscribers/{subscriber_id}
```

#### Get Subscriber Activity
Confidence
89% confidence
Finding
DELETE /mailerlite/api/subscribers/{subscriber_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Group

```bash
DELETE /mailerlite/api/groups/{group_id}
```

#### Get Group Subscribers
Confidence
87% confidence
Finding
DELETE /mailerlite/api/groups/{group_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Remove Subscriber from Group

```bash
DELETE /mailerlite/api/subscribers/{subscriber_id}/groups/{group_id}
```

### Campaign Operations
Confidence
85% confidence
Finding
DELETE /mailerlite/api/subscribers/{subscriber_id}/groups/{group_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Campaign

```bash
DELETE /mailerlite/api/campaigns/{campaign_id}
```

#### Get Campaign Subscriber Activity
Confidence
88% confidence
Finding
DELETE /mailerlite/api/campaigns/{campaign_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Automation

```bash
DELETE /mailerlite/api/automations/{automation_id}
```

### Field Operations
Confidence
86% confidence
Finding
DELETE /mailerlite/api/automations/{automation_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Field

```bash
DELETE /mailerlite/api/fields/{field_id}
```

### Segment Operations
Confidence
84% confidence
Finding
DELETE /mailerlite/api/fields/{field_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Segment

```bash
DELETE /mailerlite/api/segments/{segment_id}
```

### Form Operations
Confidence
84% confidence
Finding
DELETE /mailerlite/api/segments/{segment_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Form

```bash
DELETE /mailerlite/api/forms/{form_id}
```

#### Get Form Subscribers
Confidence
85% confidence
Finding
DELETE /mailerlite/api/forms/{form_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
#### Delete Webhook

```bash
DELETE /mailerlite/api/webhooks/{webhook_id}
```

## Pagination
Confidence
88% confidence
Finding
DELETE /mailerlite/api/webhooks/{webhook_id}

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.