Security audit

Email Drip Sequence Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward email-campaign writing skill with no bundled executable code, persistence, or hidden high-impact behavior.

Before installing, treat this as a copywriting aid only: review generated campaigns for legal compliance, add a real physical mailing address and unsubscribe link before sending, and avoid giving it subscriber lists or account credentials unless another trusted tool explicitly needs them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Ae1

High

Category: analysis-evasion
Content: {"openclaw":{"requires":{"env":["OPENAI_API_KEY"],"bins":[]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"📧"}}
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The description says to use the skill when the user needs email campaigns for 'any industry,' and lists broad needs like welcome series, product launches, and nurture campaigns without defining clearer trigger phrases or exclusion conditions. In a manifest/markdown context, this can overlap with many general marketing-writing requests and make invocation scope ambiguous.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The documentation explicitly states that all generated emails include a physical address placeholder as a CAN-SPAM requirement. However, the only concrete generated output example shown in the file does not contain such a placeholder, which directly undermines that claim and creates an intent-code/documentation divergence within the skill file itself.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The troubleshooting guidance says to generate the sequence in English first, then ask for translation, which imposes a default language choice. This is a natural-language locale policy concern because it does not offer the user a language choice up front or justify why English must be the default.

Static analysis

No suspicious patterns detected.