Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small offline cold-email drafting helper whose code matches its stated purpose and does not show hidden data access, persistence, or network behavior.
Reasonable to install if you want an offline helper for drafting two-touch cold outreach skeletons. Prefer installing from a reviewed or pinned source when possible, and review generated outreach so it is only used for legitimate prospects and not mass unsolicited spam.
Referenced artifact was not completely inspected
`scripts/sequence.mjs` turns a structured brief into a 2-touch skeleton (day 0 opener, day 7 breakup). You write the final copy — skeletons encode structure, no
The README instructs users to run npx skills without pinning a specific version, which can cause execution of whatever package version is current at install time. If the upstream package is compromised or a breaking/malicious version is published, users following the documentation could execute untrusted code on their systems.
The description says to use the skill when the user asks to "write cold outreach or a simple drip email," which is a broad natural-language trigger without clear boundaries or exclusion conditions. This can overlap with ordinary writing requests and does not specify what kinds of outreach requests should not activate the skill.
No suspicious patterns detected.