ClawHub
Back to skill

Security audit

FlashRev AI Mailer

Security checks for vulnerabilities and agentic risk

Overview

This FlashRev outreach skill is purpose-aligned but should be reviewed because it can be implicitly invoked for real email campaigns and keeps campaign/profile/mailbox metadata in local caches.

Install only if you intend to let an agent assist with FlashRev email outreach. Before use, disable or constrain implicit activation if possible, require explicit confirmation for every live send/reply/reschedule/delete/AI auto-reply action, set the timezone explicitly, and treat `.flashrev/` as sensitive local data that should not be committed, shared, or left behind on shared machines.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The manifest description is very broad and can trigger on ordinary requests involving email, follow-up, triage, or campaign planning, causing the skill to activate outside narrowly intended contexts. Because this skill performs high-impact outbound communications and production state changes, overbroad routing increases the chance an agent invokes risky mail-sending workflows when the user only wanted general advice or drafting help.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The documented fallback to timezone id 22 / America/New_York applies scheduling behavior without explicit user opt-in when the profile cannot be fetched. In a live outreach tool, that can cause emails to be queued or sent at unintended local times, potentially breaching business rules, compliance expectations, or user intent.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill allows implicit invocation with no trigger phrases or activation constraints, which means an agent may auto-select this mailer skill based on broad user requests involving email or outreach. In this context, the skill can create campaigns, commit sequences, triage replies, and potentially progress toward live sending or AI auto-reply workflows, so accidental activation increases the risk of unintended outreach actions or exposure of sensitive mailbox/campaign data.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The contract states that user profile, timezone data, and inbox metadata are cached on disk, including mappings that can tie message IDs, contacts, addresses, and sequence information together. In an AI-agent workflow, silent persistence of this data increases the risk of local data leakage, unintended cross-task reuse, and exposure on shared machines or CI runners if file permissions and retention are not tightly controlled.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/api_contract.md:13