Security audit

Email Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it handles marketing API secrets and subscriber data with inconsistent documentation and weak safety controls, so users should review it carefully before installing.

Install only if you are comfortable reviewing and controlling shell scripts that use a ConvertKit API secret, can change live marketing account data, and can store subscriber-related reports locally. Use a test account or test sequence first, protect and rotate API credentials if exposed in logs, verify recipient/list/sequence targets before running anything, and do not rely on the advertised Mailchimp or one-off-send features without additional implementation review.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

Location: lib/convertkit-api.sh:35
Finding: ConvertKit API Secret Exposed in URL Query Parameters
Content: View full analysis
Vulnerability Details

File Location: lib/convertkit-api.sh:35 and lib/convertkit-api.sh:62-66
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: Medium

Vulnerable Code

bash
# List all sequences convertkit_list_sequences() { check_convertkit_auth || return 1 curl -s "$CONVERTKIT_API_BASE/sequences?api_secret=$CONVERTKIT_API_SECRET" }

bash
# Get sequence subscribers convertkit_get_subscribers() { local sequence_id="$1" check_convertkit_auth || return 1 curl -s "$CONVERTKIT_API_BASE/sequences/$sequence_id/subscriptions?api_secret=$CONVERTKIT_API_SECRET" }

Technical Analysis

The ConvertKit API secret is embedded directly in URL query parameters. Although HTTPS protects the URL while it travels over the network, complete URLs can still be exposed through local process inspection, HTTP proxy logs, diagnostic traces, server access logs, monitoring platforms, or shell debugging output.

Query parameters are generally unsuitable for long-lived credentials because URL handling infrastructure commonly records them. The affected functions are invoked by connection testing and sequence monitoring operations.

Attack Path

A user exports a valid CONVERTKIT_API_SECRET.

The user runs the monitoring script or calls one of the affected wrapper functions.

The secret is inserted into the complete curl URL.

A local observer, proxy, debugging facility, or request-logging system records that URL.

An attacker extracts the secret from the recorded URL.

The attacker reuses the credential against the ConvertKit API.

Impact Assessment

An exposed API secret can permit unauthorized ConvertKit API operations within the privileges granted to that credential. Potential scope includes viewing sequence and subscriber information and performing supported account-level sequence or subscriber operations.

Thi ...[truncated 144 chars]
Remediation: View remediation
Remediation Suggestions

Use ConvertKit's supported authorization-header mechanism where available.

If the API version requires body-based authentication, place the secret in the HTTPS request body instead of the URL.

Avoid verbose shell tracing and HTTP debugging around authenticated requests.

Ensure logs redact authorization values and known secret fields.

Use a narrowly scoped credential if the platform supports scopes.

Rotate any API secret that may already have appeared in process telemetry or logs.

T09 · Insecure Skill Coding Practices

Warning

Location: lib/convertkit-api.sh:18
Finding: Unsafe Manual JSON Construction in ConvertKit API Requests
Content: View full analysis
Vulnerability Details

File Location: lib/convertkit-api.sh:18-29, lib/convertkit-api.sh:40-59, and lib/convertkit-api.sh:69-86
Vulnerability Type: JSON injection and malformed API request construction
Risk Level: Medium

Vulnerable Code

bash
convertkit_create_sequence() { local sequence_name="$1" check_convertkit_auth || return 1 curl -s -X POST "$CONVERTKIT_API_BASE/sequences" \ -H "Content-Type: application/json" \ -d "{ \"api_secret\": \"$CONVERTKIT_API_SECRET\", \"name\": \"$sequence_name\" }" }

bash
convertkit_subscribe_to_sequence() { local sequence_id="$1" local email="$2" local first_name="${3:-}" check_convertkit_auth || return 1 local data="{ \"api_secret\": \"$CONVERTKIT_API_SECRET\", \"email\": \"$email\"" if [[ -n "$first_name" ]]; then data="$data, \"first_name\": \"$first_name\"" fi data="$data }" curl -s -X POST "$CONVERTKIT_API_BASE/sequences/$sequence_id/subscribe" \ -H "Content-Type: application/json" \ -d "$data" }

bash
convertkit_add_email() { local sequence_id="$1" local subject="$2" local content="$3" local delay_days="${4:-0}" check_convertkit_auth || return 1 curl -s -X POST "$CONVERTKIT_API_BASE/sequences/$sequence_id/emails" \ -H "Content-Type: application/json" \ -d "{ \"api_secret\": \"$CONVERTKIT_API_SECRET\", \"subject\": \"$subject\", \"content\": \"$content\", \"delay_days\": $delay_days }" }

Technical Analysis

User-controlled values are interpolated directly into JSON strings without JSON encoding. Values containing quotation marks, backslashes, control characters, or newlines can terminate the intended JSON string, add properties, or make the request invalid.

The numeric delay_days value is also inserted as raw JSON witho ...[truncated 1361 chars]
Remediation: View remediation
Remediation Suggestions

Construct payloads with jq -n rather than string concatenation.

Pass strings with --arg and numeric values with --argjson after strict validation.

Validate sequence IDs against the exact API identifier format.

Validate delay_days as a bounded nonnegative integer.

Use curl --fail-with-body --show-error and verify HTTP status codes.

Treat API errors as failures instead of returning arbitrary response bodies as successful output.

Example:

bash
[[ "$delay_days" =~ ^[0-9]+$ ]] || { echo "Error: delay_days must be a nonnegative integer" >&2 return 1 } payload=$(jq -n \ --arg secret "$CONVERTKIT_API_SECRET" \ --arg subject "$subject" \ --arg content "$content" \ --argjson delay_days "$delay_days" \ '{ api_secret: $secret, subject: $subject, content: $content, delay_days: $delay_days }') curl --fail-with-body --silent --show-error \ -X POST "$CONVERTKIT_API_BASE/sequences/$sequence_id/emails" \ -H "Content-Type: application/json" \ --data-binary "$payload"

T09 · Insecure Skill Coding Practices

Warning

Location: create-sequence.sh:92
Finding: Unescaped CLI Inputs Used to Generate Sequence JSON
Content: View full analysis
Vulnerability Details

File Location: create-sequence.sh:92-140
Vulnerability Type: JSON injection and unsafe structured-data generation
Risk Level: Medium

Vulnerable Code

bash
# Build email list EMAILS=() for i in $(seq 1 "$EMAIL_COUNT"); do DELAY_DAYS_VAL="${DELAYS[$((i-1))]:-0}" # Select template based on type and email number TEMPLATE="$SCRIPT_DIR/templates/${SEQUENCE_TYPE}-email-${i}.md" # Fallback to generic if specific doesn't exist if [[ ! -f "$TEMPLATE" ]]; then TEMPLATE="$SCRIPT_DIR/templates/${SEQUENCE_TYPE}-email-generic.md" fi # Build email object EMAIL_JSON=$(cat <<EOF { "emailNumber": $i, "delayDays": $DELAY_DAYS_VAL, "template": "$TEMPLATE", "subject": "Email $i subject (to be filled from template)", "status": "draft" } EOF ) EMAILS+=("$EMAIL_JSON") done # Build sequence JSON SEQUENCE_JSON=$(cat <<EOF { "sequenceName": "$SEQUENCE_NAME", "type": "$SEQUENCE_TYPE", "product": "$PRODUCT_NAME", "platform": "$PLATFORM", "status": "draft", "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "emails": [ $(IFS=,; echo "${EMAILS[*]}") ], "metadata": { "emailCount": $EMAIL_COUNT, "launchDate": "${LAUNCH_DATE:-null}" } } EOF ) # Write to file echo "$SEQUENCE_JSON" | jq '.' > "$OUTPUT_FILE"

Technical Analysis

Product names, platform values, launch dates, delay values, and email counts are inserted into JSON without safe serialization. Only the sequence type is constrained. A value containing JSON delimiters can alter the generated structure, while invalid numeric input can produce malformed JSON or unexpected behavior in seq.

The final jq command detects some malformed payloads, but it does not prevent semantic injection when the crafted result remains valid JSON.

The user-controlled --output option also permits writing to ...[truncated 1049 chars]
Remediation: View remediation
Remediation Suggestions

Validate EMAIL_COUNT as a bounded positive integer before passing it to seq.

Validate each delay as a bounded nonnegative integer.

Restrict PLATFORM to implemented values.

Validate launch dates with a strict format and calendar check.

Generate each object using jq -n --arg --argjson.

Build the email collection as a JSON array rather than joining JSON strings.

If arbitrary output paths are unnecessary, constrain output to a dedicated sequence directory.

Create output files with a restrictive umask, use a temporary file, and atomically rename the completed file.

T09 · Insecure Skill Coding Practices

Warning

Location: monitor-sequences.sh:64
Finding: Remote Sequence Names Are Written to Reports Without JSON Encoding
Content: View full analysis
Vulnerability Details

File Location: monitor-sequences.sh:64-101
Vulnerability Type: Stored JSON injection in generated reports
Risk Level: Medium

Vulnerable Code

bash
echo "$SEQUENCES" | jq -r '.sequences[] | @json' | while IFS= read -r seq; do SEQ_ID=$(echo "$seq" | jq -r '.id') SEQ_NAME=$(echo "$seq" | jq -r '.name') echo "" echo "Analyzing: $SEQ_NAME (ID: $SEQ_ID)" # Get subscribers SUBSCRIBERS=$(convertkit_get_subscribers "$SEQ_ID") SUBSCRIBER_COUNT=$(echo "$SUBSCRIBERS" | jq '.total_subscribers // 0') echo " Subscribers: $SUBSCRIBER_COUNT" # Build report REPORT_FILE="$OUTPUT_DIR/sequence-${SEQ_ID}-$(date +%Y-%m-%d).json" cat > "$REPORT_FILE" <<EOF { "sequenceId": "$SEQ_ID", "sequenceName": "$SEQ_NAME", "reportDate": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")", "periodDays": $DAYS, "subscribers": $SUBSCRIBER_COUNT, "emails": [], "performance": { "avgOpenRate": 0, "avgClickRate": 0, "avgBounceRate": 0, "totalRevenue": 0, "conversionRate": 0 } } EOF echo " Report saved: $REPORT_FILE" done

Technical Analysis

SEQ_NAME originates from the ConvertKit API response and is decoded into a raw string using jq -r. It is subsequently embedded directly into a JSON heredoc. A sequence name containing quotation marks, backslashes, newlines, or crafted JSON fragments can corrupt or alter the generated report.

DAYS, sequence identifiers, and subscriber-count data are also inserted as raw JSON values without complete local type validation. Because sequence names are remotely stored account data, this represents a stored injection path into local reports.

Attack Path

An attacker with the ability to create or rename a sequence in the connected ConvertKit account creates a name containing crafted JSON syntax.

The monitor retrieves that sequence through `c ...[truncated 747 chars]
Remediation: View remediation
Remediation Suggestions

Construct reports entirely with jq -n.

Pass sequence IDs and names using --arg.

Validate DAYS and subscriber counts as bounded integers before using --argjson.

Reject unexpected sequence-ID formats before using them in report filenames.

Write to a temporary file and atomically rename it after successful JSON validation.

Validate every completed report with jq -e before exposing it to downstream consumers.

T09 · Insecure Skill Coding Practices

Warning

Location: test-integration.sh:62
Finding: Predictable Temporary File Allows Symlink-Based File Overwrite
Content: View full analysis
Vulnerability Details

File Location: test-integration.sh:62-80
Vulnerability Type: Insecure temporary-file creation and symlink following
Risk Level: Medium

Vulnerable Code

bash
# Test 4: Create test sequence (dry run) log_info "Test 4: Creating test sequence..." TEST_OUTPUT="/tmp/test-sequence-$$.json" if "$SCRIPT_DIR/create-sequence.sh" \ --type welcome \ --product "Test Product" \ --emails 3 \ --delay-days "0,3,7" \ --output "$TEST_OUTPUT" >/dev/null 2>&1; then if [[ -f "$TEST_OUTPUT" ]] && jq -e '.sequenceName' "$TEST_OUTPUT" >/dev/null 2>&1; then log_pass "Sequence creation works (valid JSON output)" rm -f "$TEST_OUTPUT" else log_fail "Sequence file created but invalid JSON" fi else log_fail "Sequence creation failed" fi

The target is opened by ordinary redirection in create-sequence.sh:140:

bash
echo "$SEQUENCE_JSON" | jq '.' > "$OUTPUT_FILE"

Technical Analysis

The integration test creates a predictable pathname in the shared /tmp directory using the process ID. It does not securely reserve the file before use and does not protect against a pre-existing symbolic link.

Shell output redirection follows symbolic links. Consequently, an attacker who creates the expected pathname as a symlink can cause generated JSON to overwrite another file writable by the test process.

Process IDs are observable and drawn from a limited range. This makes pre-creation or racing of the temporary pathname practical in a multi-user environment.

Attack Path

An attacker monitors for the integration-test process or predicts candidate process IDs.

The attacker creates /tmp/test-sequence-<PID>.json as a symbolic link to a target file.

A more privileged user or automation service runs test-integration.sh with that PID.

create-sequence.sh opens the attacker-controlled symli ...[truncated 619 chars]
Remediation: View remediation
Remediation Suggestions

Create a private temporary directory using mktemp -d.

Set umask 077 before creating temporary files.

Register cleanup with trap so it runs on success, failure, and interruption.

Keep all test artifacts inside the private temporary directory.

Do not run the integration test as root.

Where possible, use exclusive file creation and reject symbolic links.

Example:

bash
umask 077 TEST_DIR=$(mktemp -d "${TMPDIR:-/tmp}/email-automation-test.XXXXXX") trap 'rm -rf -- "$TEST_DIR"' EXIT HUP INT TERM TEST_OUTPUT="$TEST_DIR/test-sequence.json"

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill primarily runs validation tests and filesystem checks instead of performing the promised email automation, it creates a deceptive operational profile. That can cause agents or users to invoke a broader local-testing workflow than intended, exposing local environment details or writing artifacts while bypassing normal scrutiny due to the misleading description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill primarily runs validation tests and filesystem checks instead of performing the promised email automation, it creates a deceptive operational profile. That can cause agents or users to invoke a broader local-testing workflow than intended, exposing local environment details or writing artifacts while bypassing normal scrutiny due to the misleading description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the skill primarily runs validation tests and filesystem checks instead of performing the promised email automation, it creates a deceptive operational profile. That can cause agents or users to invoke a broader local-testing workflow than intended, exposing local environment details or writing artifacts while bypassing normal scrutiny due to the misleading description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The deployment summary describes building and operating subscriber-management and email-sequence tooling, but it does not warn operators that subscriber email addresses, engagement metrics, and possibly purchase-related data will be transmitted to third-party platforms such as ConvertKit. In a marketing automation context, omission of privacy/data-handling guidance can lead to unauthorized processing, noncompliant data sharing, and accidental exposure of personal data through logs, reports, or misconfigured integrations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 85)May include surrounding context.
md
# 1. Set API key export CONVERTKIT_API_SECRET="your_secret_here" # 2. Create welcome sequence ./create-sequence.sh \ --type welcome \ --product "AI Tax Optimizer" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown describes creating sequences, adding subscribers, and deploying campaigns programmatically, which can affect user data and live marketing systems. It does not include any warning or caution about operating on real subscriber lists, using test environments, or verifying targets before deployment.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell-style command execution examples but declares no explicit tool restrictions or permission scope. That creates an authorization and governance gap: an agent may invoke shell-capable behavior without clear constraints, increasing the risk of unintended command execution or misuse if the implementation is broader than documented.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest has no trigger patterns or activation constraints, which can make the skill easier to invoke in unintended contexts. For a skill associated with shell-capable or side-effecting operations, broad activation increases the chance of accidental execution, misuse, or invocation based on vague user prompts.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · lib/convertkit-api.sh (reported line 4)May include surrounding context.
sh
#!/usr/bin/env bash # ConvertKit API wrapper functions CONVERTKIT_API_BASE="https://api.convertkit.com/v3" # Check if API key is set check_convertkit_auth() {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Although the script checks that the environment variable is set, it does not disclose in comments or user-facing output for the API functions that a secret credential will be consumed and sent to the remote service. Access to sensitive environment variables and transmitting credentials are safety-relevant operations under this rule.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · lib/convertkit-api.sh (reported line 23)May include surrounding context.
sh
local sequence_name="$1" check_convertkit_auth || return 1 curl -s -X POST "$CONVERTKIT_API_BASE/sequences" \ -H "Content-Type: application/json" \ -d "{ \"api_secret\": \"$CONVERTKIT_API_SECRET\",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · lib/convertkit-api.sh (reported line 56)May include surrounding context.
sh
data="$data }" curl -s -X POST "$CONVERTKIT_API_BASE/sequences/$sequence_id/subscribe" \ -H "Content-Type: application/json" \ -d "$data" }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code sends user personal data to an external network service via curl, but the function contains no confirmation prompt and no user-facing warning beyond a terse usage comment. For code files, outbound transmission of user data should have some visible disclosure unless clearly documented as the skill's stated purpose.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The function constructs JSON by directly interpolating untrusted subject and content into a shell string sent to curl. If these values contain quotes, backslashes, or crafted JSON fragments, they can break request structure, inject unintended fields, or cause malformed requests, leading to content manipulation or unreliable API behavior.
Content: Scanner excerpt · lib/convertkit-api.sh (reported line 78)May include surrounding context.
sh
local delay_days="${4:-0}" check_convertkit_auth || return 1 curl -s -X POST "$CONVERTKIT_API_BASE/sequences/$sequence_id/emails" \ -H "Content-Type: application/json" \ -d "{ \"api_secret\": \"$CONVERTKIT_API_SECRET\",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script retrieves subscriber-related sequence data from an external email platform and then writes reports to disk, but it does not disclose that customer/marketing data will be stored locally. The existing echo statements only indicate progress and file paths, not the privacy impact or data-handling behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The quick start instructs users to export ConvertKit and Mailchimp credentials, but the documentation does not warn that these are sensitive secrets or advise against exposing them in shells, logs, or shared environments. For a skill that uses external marketing platforms, some disclosure about credential sensitivity is expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code performs a file write to the user-specified or default output path, but there is no confirmation prompt or advance disclosure before the write occurs. Although the script prints a success message afterward, the criteria call for flagging safety-relevant file writes when they lack user-facing warning or confirmation beforehand.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This shell script reads the sensitive environment variable CONVERTKIT_API_SECRET and, when present, performs a real ConvertKit API connection test. Although the script logs that it is testing the API connection, it does not warn the user that running the test will use stored credentials to contact an external service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Missing User Warnings

Session Persistence

Missing User Warnings

Undeclared Tool Scope

Vague Triggers

External Transmission

Missing User Warnings

External Transmission

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis