Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for FlashRev email automation, but needs review because it relies on an unpinned global email-sending CLI and can be invoked broadly for high-impact outbound mail.
Review before installing. Use this skill only when you intend to operate FlashRev campaigns, pin and verify the flashrev-ai-mailer package if possible, run it with least privilege, protect the FlashRev API key, check the .flashrev cache contents, and confirm recipients, drafts, schedule, timezone, and any auto-reply prompt before live operations.
- **CLI is installed globally**: `npm install -g flashrev-ai-mailer`. Verify
with `flashrev-mailer --help`. Confirm version 2.x:
`flashrev-mailer --help 2>&1 | head -1` should not look like the v1 single-shot CLI.
Technical Analysis
The Skill directs the operator to install the latest npm-resolved version of flashrev-ai-mailer globally. It does not specify an exact version, use a lockfile, require integrity verification, or include the CLI implementation within the audited project.
The package operates with access to FLASHREV_API_KEY, prospect records, campaign state, and live mailbox functionality. Although the documentation contains approval safeguards, the absent external implementation cannot be audited to verify that it enforces those safeguards. Version verification limited to checking whether the CLI appears to be from the 2.x family does not establish package authenticity or ensure that the installed release is the audited version.
Attack Path
An attacker compromises the npm package, its publisher account, or a subsequently published release.
The operator follows the documented command:
bash
npm install -g flashrev-ai-mailer
npm resolves and installs the compromised release because no exact version or integrity value is required.
Malicious package lifecycle scripts may execute during installation, or malicious runtime logic may execute when the agent invokes the CLI.
The package can access the operator's privileges, FLASHREV_API_KEY, local .flashrev/ campaign data, prospect information, and configured FlashRev services.
The malicious implementation could exfiltrate sensitive data, modify campaign parameters, or perform unauthorized mailbox and email operations.
Impact Assessment
...[truncated 762 chars]
Remediation
View remediation
Remediation Suggestions
Pin the package to an audited exact version rather than relying on the latest registry resolution:
bash
npm install --save-exact flashrev-ai-mailer@2.0.1
Prefer a workspace-local installation over a global installation, and invoke it through a controlled package script or an explicitly resolved local binary.
Commit a lockfile that records the complete dependency graph and registry integrity hashes.
Verify the package name, publisher, registry origin, provenance, signatures, and integrity before installation.
Disable npm lifecycle scripts where operationally feasible:
bash
npm install --ignore-scripts
If lifecycle scripts are required, audit them before allowing execution.
Include the CLI source code or a reproducibly built artifact within the audit boundary so its credential handling, approval controls, network requests, and filesystem operations can be verified.
Run the CLI with least privilege in an isolated environment and expose only the specific API credential and workspace files it requires.
Rotate the FlashRev API key and review campaign activity if package compromise is suspected.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content
Scanner excerpt · references/api_contract.md (reported line 212)May include surrounding context.
md
steps not in the payload are deleted)
3. `POST /sequence/edit` with the full reconstructed payload
The same Full-Replace rule applies to `sequence/setting/edit` for properties
updates (timeTemplateId / aiAutoReply / etc.).
## Field traps (13 commonly hit)
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The skill description is scoped broadly enough to trigger on many generic outreach or email-related requests, which can cause an agent to invoke a high-impact sending tool in contexts where the user did not specifically request FlashRev campaign operations. Because this skill can progress toward real outbound emailing, overbroad activation increases the chance of unintended access to campaign state, recipient data, or production-affecting actions.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
run `--dry-run --yes` first, show rendered drafts and the destination
mailbox to the user, and only proceed with `--live --yes` after the user
approves drafts, schedule, and recipient set. The agent never auto-escalates
batch size, never auto-resumes after pause without confirmation.
- **`ai-auto-reply enable` is high-risk.** Once enabled, the LLM will reply to
prospects on the user's behalf using the saved prompt. The agent must:
1. Show the full prompt verbatim to the user before calling `enable`
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
Defaulting to America/New_York when the user's actual timezone cannot be determined can cause messages to be scheduled and sent at unintended local times without explicit user consent. In an outbound email system, that can create compliance, reputational, and operational harm by sending off-hours or on the wrong business day.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
This markdown file documents use of an API key for authentication and later describes caching user profile and inbox-related metadata locally. Under the markdown-file criteria for missing user warnings, the document does not include any explicit warning that credentials and cached data may be sensitive or affect user privacy.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
92% confidence
Finding
These lines state that the CLI caches profile data and timezone data under .flashrev/ files, which affects user data storage on disk. The markdown does not warn users that personal/account information will be written locally or advise how to manage or clear that cache.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
93% confidence
Finding
This section says the CLI stores a mapping including message IDs, contact IDs, subjects, and recipient information in .flashrev/inbox-cache.json. Because this is inbox-derived user data stored locally, the markdown should warn about the privacy implications and local persistence behavior.
Content
No source excerpt is available for this finding.
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
