Campaign Tracker

This skill appears to implement campaign tracking and reporting, but it expects to read files and modules from other skills (e.g. EMAIL_SKILL_ROOT) and even loads a .env from that location — which may contain IMAP/SMTP credentials or other secrets. Before installing or running: 1) Inspect the scripts yourself (archive-sent-records.js, reply-matcher.js, analytics-report.js, template-optimizer.js) — they will be executed by node. 2) Do not point EMAIL_SKILL_ROOT to a live production skill directory that contains credentials unless you have reviewed and sanitized its .env and scripts. 3) Prefer running first in dry-run mode and in an isolated/test environment (or container) so it cannot read unrelated files. 4) Verify what OKKI_VECTOR_SEARCH should point to and whether it invokes remote services or scripts. 5) If you need to use this, explicitly set the required environment variables to trusted, minimal locations and avoid sharing cross-skill secrets. Providing explicit documentation from the author that clarifies which env vars are required and that the skill will not load other skills' secrets would reduce risk and could change this assessment to 'benign'.