Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed email-marketing reference skill with strong human-approval gates for live sends and no evidence of hidden execution or data theft.
Reasonable to install if you want an agentic email-marketing playbook. Only connect it to ESP, SMS, WhatsApp, or customer-data tools with the least access needed, keep the skill's preview and explicit approval gates in place before any send, and verify current legal/platform rules before acting on volatile compliance or deliverability claims.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
*~
# Env
.env
# Internal project files (not for public distribution)
memory.md
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- uses: actions/checkout@v4
- name: Plugin copy matches root SKILL.md
run: |
cmp SKILL.md skills/email-marketing-bible/SKILL.md || {
echo "::error::skills/email-marketing-bible/SKILL.md must match SKILL.md (the plugin directory reads the copy, git-clone installs read the root). Copy SKILL.md over it."
exit 1
}
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- uses: actions/checkout@v4
- name: Plugin copy matches root SKILL.md
run: |
cmp SKILL.md skills/email-marketing-bible/SKILL.md || {
echo "::error::skills/email-marketing-bible/SKILL.md must match SKILL.md (the plugin directory reads the copy, git-clone installs read the root). Copy SKILL.md over it."
exit 1
}
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| CASL (Canada) | Yes | implied consent 2yr after purchase, express = indefinite | up to $10M CAD |
| Spam Act (AU) | Yes | consent + sender ID + unsubscribe ≤5 business days | up to $2.22M AUD/day |
One-click unsubscribe (RFC 8058) required at 5K+/day to Gmail/Yahoo/Microsoft; honour within 48h. **AI does not transfer liability:** you own an agent's sends; never trust it to preserve the unsubscribe or footer when it edits a template. Cold email: B2B legal without consent in US/UK, consent required in Canada/Australia.
## 14. COLD EMAIL
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| CASL (Canada) | Yes | implied consent 2yr after purchase, express = indefinite | up to $10M CAD |
| Spam Act (AU) | Yes | consent + sender ID + unsubscribe ≤5 business days | up to $2.22M AUD/day |
One-click unsubscribe (RFC 8058) required at 5K+/day to Gmail/Yahoo/Microsoft; honour within 48h. **AI does not transfer liability:** you own an agent's sends; never trust it to preserve the unsubscribe or footer when it edits a template. Cold email: B2B legal without consent in US/UK, consent required in Canada/Australia.
## 14. COLD EMAIL
L121 tells the agent to generate a random seed string in a shell using openssl rand -base64 48. Spawning shell commands is not a direct or necessary capability for an email-marketing reference skill; it is an implementation suggestion that expands into system-level execution outside the stated marketing/advisory purpose.
No suspicious patterns detected.