Campaign Tracker

• Outcome: Review
• Latest audit: May 28, 2026 · 6:38 AM UTC
• Version: 1.0.0

Overview

This is a coherent email-campaign tracking skill, but it needs Review because it reads sensitive local email data and writes persistent reports/config changes with weak scoping and some documentation mismatches.

Install only if you are comfortable giving this skill access to local email-system data, including draft/review/captured inbox files, and allowing it to persist campaign analytics locally. Set EMAIL_SKILL_ROOT, OBSIDIAN_VAULT, and processed-file paths deliberately, run dry-run first, review generated archives before trusting metrics, avoid shared or synced Obsidian vaults for sensitive customer data, and inspect config changes before running template optimization live.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill clearly relies on environment variables such as EMAIL_SKILL_ROOT, CAMPAIGN_TRACKER_ROOT, OKKI_VECTOR_SEARCH, and OBSIDIAN_VAULT, but no permissions or trust boundaries are declared. This creates hidden capability exposure: the skill can read configuration and interact with external paths and integrations without users being explicitly warned about those accesses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose suggests tracking and analysis, but the behavior includes modifying archive records, updating A/B testing configuration, reading from external mail-system directories, and writing reports into an Obsidian vault. That mismatch is security-relevant because operators may grant the skill broader trust than intended, enabling unexpected data modification and exfiltration into secondary storage locations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is intended to archive sent-email records, but it ingests `reviews-pending` and `drafts` and later labels non-sent items as archiveable campaign send records. In this skill context, that creates integrity and privacy risk: unsent or internal draft content can be treated as outbound customer communication, corrupting campaign analytics and potentially exposing draft/customer data in downstream reports or systems that assume archived records were truly sent.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documented behavior says the script reads sent-email records, but the implementation actually reads pending-review and draft files. This mismatch is dangerous because operators and downstream components may trust the archive as a record of actual sent mail, leading to false business evidence, incorrect attribution, and accidental handling of internal draft content as if it were customer-facing communication.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The README describes collecting, storing, and analyzing sent emails and customer replies, including AI intent classification, but does not warn users about handling potentially sensitive personal or business communications. In a marketing-tracking skill, this omission can lead to accidental over-collection, insecure retention, or processing of personal data without appropriate consent, notice, or access controls.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README states that reports are automatically written to a fixed local Obsidian vault path, but does not prominently warn that running the skill will create or modify local files outside the project directory. This can expose sensitive campaign analytics and customer reply data to unintended locations, backups, sync services, or other users of the workstation.

Credential Access

High

• Category: Privilege Escalation

Content

const emailSkillPath = process.env.EMAIL_SKILL_ROOT || '<path-to-imap-smtp-email>';

// reply-matcher.js 使用 IMAP 收件箱
const imapConfig = require(process.env.EMAIL_SKILL_ROOT + '/.env');

// 客户匹配使用 OKKI 向量搜索
const vectorSearch = process.env.OKKI_VECTOR_SEARCH || '<path-to-okki_vector_search_v3.py>';

• Confidence: 92% confidence
• Finding: The skill documentation shows loading another skill's .env file via require(process.env.EMAIL_SKILL_ROOT + '/.env'), which indicates direct access to sensitive configuration and likely credentials for IMAP/SMTP. Reading secrets from an external path expands the blast radius of compromise and may leak or misuse credentials, especially if the environment-derived path is attacker-controlled or insufficiently validated.

Static analysis

No suspicious patterns detected.