Email Automation
v0.1.0Send and automate emails using ConvertKit or Mailchimp.
⭐ 0· 80·0 current·0 all-time
byRunByDaVinci@clawdiri-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code is focused on ConvertKit (lib/convertkit-api.sh) which matches the description, but the registry metadata declares no required environment variables or primary credential even though the scripts require CONVERTKIT_API_SECRET at runtime. README and other docs also reference Mailchimp, Python scripts, and MAILCHIMP_API_KEY that are not implemented in the repo. These mismatches mean the declared requirements do not align with the skill's actual needs.
Instruction Scope
SKILL.md provides CLI-like usage examples but does not declare the required ConvertKit env var. The runtime scripts (create-sequence.sh, monitor-sequences.sh, convertkit-api.sh) only call ConvertKit endpoints and write local JSON reports under the skill directory; they do not read broad system state or other credentials. However templates include example shell commands (npm install -g, activation commands) and the scripts reference a deploy script (deploy-sequence.sh) that isn't present—these are scope/documentation inconsistencies that could confuse users.
Install Mechanism
There is no install specification (instruction-only deployment) and the skill is packaged as scripts and templates. No external downloads or extract steps are present in the manifest. This is low-install risk, but the files will be executed locally if the user runs the scripts.
Credentials
The scripts require a ConvertKit API secret (CONVERTKIT_API_SECRET) but the registry metadata lists no required env vars or primary credential. README also references MAILCHIMP_API_KEY and Python dependencies that are not present in the code. Requesting no credentials at install time while requiring an API secret at runtime is disproportionate and inconsistent.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It does not request persistent system privileges or modify other skills' configs. It writes its own sequences and reports into subdirectories under the skill workspace and uses /tmp in tests—standard and limited scope.
What to consider before installing
This skill appears to implement ConvertKit automation, but the package metadata and documentation are inconsistent. Before installing or running it: 1) Do not provide unrelated credentials—only set CONVERTKIT_API_SECRET if you intend to use ConvertKit. 2) Inspect lib/convertkit-api.sh and test-integration.sh yourself; the scripts use curl/jq to talk to ConvertKit and write local JSON files. 3) Note README references (Mailchimp, Python scripts, deploy-sequence.sh) that are missing—expect some manual wiring or missing features. 4) Run the integration tests in an isolated environment (and avoid using a production API key for initial tests). 5) If you expect Mailchimp support or Python tooling, ask the publisher for a clarified version; otherwise treat this as a ConvertKit-only bash utility and verify it meets your security/operational requirements.Like a lobster shell, security has layers — review code before you run it.
latestvk97fmg8471kgjz2ye3z25sxws583cay0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.