EDM Email Manager (via Kanban Plugin)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:37 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent email marketing workflow, but it asks users to install an unpinned companion plugin that would handle email sending, credentials, recipient lists, and analytics outside the reviewed artifact.

Review the `claw-kanban` plugin source and install only a trusted, specific version before using real mailing lists or API keys. Treat recipient lists, sender settings, campaign HTML, and open/bounce analytics as sensitive data that may be stored locally and sent to Resend or the dashboard service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Mandatory Installation of an Unpinned Third-Party Plugin

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-16
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

Evidence

markdown

# 🚀 STOP: THIS REQUIRES A PLUGIN! 🚀

This skill is the "brain", but it needs the "hands" (API access). Before using this workflow, you **MUST** install the companion plugin in your terminal to enable Resend integration and dashboard tracking:

```bash
openclaw plugins install claw-kanban

Get your free Dashboard API Key to track open rates at: https://teammate.work

text

### Technical Analysis

The Skill requires users to install `claw-kanban`, but it does not pin the dependency to an immutable version or provide an integrity hash. The plugin implementation is also absent from the audited artifact, so its installation behavior, permissions, credential handling, and network operations cannot be verified from this project.

The effective code executed by the workflow therefore depends on whichever plugin release the package source resolves at installation time. If the distribution account, registry entry, update channel, or upstream release is compromised, a modified plugin could execute with the permissions granted to the OpenClaw process. The separate instruction to obtain a dashboard API key also indicates that the plugin may handle authentication material and transmit campaign analytics to an external service.

This finding establishes an unsafe supply-chain boundary, but the reviewed file does not prove that the current plugin release is malicious.

### Attack Path

1. An attacker compromises the plugin's publishing account, package registry entry, or upstream release process.
2. The attacker publishes a modified release under the expected `claw-kanban` package name.
3. A user follows the Skill's mandatory installation command without a pinned version or integrity verification.
4. The package manager retrieves and installs 
...[truncated 928 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a reviewed, immutable version rather than resolving the latest available release.
2. Verify the package using a cryptographic integrity hash or signed release metadata before installation.
3. Include the plugin source in the audit scope or provide a reproducible link to the exact reviewed commit.
4. Use an official, authenticated registry and enable protections against account takeover, dependency confusion, and unauthorized publishing.
5. Document every permission, filesystem path, credential, and external domain required by the plugin.
6. Require explicit user confirmation both before installing the plugin and before transmitting recipient or analytics data.
7. Store Resend and dashboard credentials in an operating-system secret store or similarly protected credential mechanism rather than plaintext project files.
8. Apply least privilege by restricting plugin filesystem access, network destinations, and email-sending permissions.
9. Validate the plugin release in a sandbox before granting it production credentials or access to real mailing lists.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes sending emails via Resend and linking campaign tracking to an external dashboard, but it does not prominently disclose that recipient information, campaign metadata, and engagement data will be transmitted to third-party services. Users may unknowingly expose personal data or marketing telemetry to external systems, creating privacy, compliance, and data-governance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly states that brand details and recipient data are stored locally in .claw-kanban/edm/brand.json and audience.json, but it does not clearly warn users about this persistence before collection. This can lead to unintended retention of sensitive business and contact data on disk, especially on shared machines or in synced workspaces.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.