Ecommerce Email Marketing Builder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:50 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent email-marketing helper, but it uses mutable global install commands and gives risky guidance for pre-selected marketing consent.

Review the install source before running the npx commands, prefer a pinned or project-local install if available, and avoid implementing the pre-checked email opt-in as written; use explicit customer consent and jurisdiction-specific compliance review for marketing subscriptions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Packages and Skills Installed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–22 and 574–582
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-email-marketing-builder -g

text

Additional installation commands:

```markdown
For paid advertising strategy across Google, Meta, and TikTok:
```bash
npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-ppc-strategy-planner -g

For full omnichannel marketing strategy (includes email as one channel):

bash

npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-marketing-strategy-builder -g

text

### Technical Analysis

The documented commands invoke `npx` without pinning the `skills` runner to a reviewed version. The referenced repository and skills are also not pinned to an immutable release, tag, commit hash, checksum, or signature.

Consequently, the resources retrieved when a user runs these commands may differ from the versions that existed when this project was audited. If the npm package, publishing account, repository, or dependency chain is compromised, an attacker could distribute altered installer logic or malicious skill instructions. The `-g` argument increases exposure by installing the retrieved skill globally rather than limiting it to an isolated project environment.

The audited file does not itself contain a malicious payload, and exploitation depends on a future or existing compromise of an external supply-chain component. Nevertheless, the installation pattern does not provide sufficient integrity or reproducibility controls.

### Attack Path

1. An attacker compromises the npm package used by `npx`, its maintainer account, the referenced GitHub repository, or another component in the installation chain.
2. The attacker publishes a modified package or skill under the same mutable identifier.
3. A user follows the installation instructions in `SKILL
...[truncated 999 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills package to an explicitly reviewed version instead of allowing npx to resolve the latest release.
2. Pin the referenced skill repository to an immutable commit hash or cryptographically signed release.
3. Publish and verify checksums or signatures for downloaded artifacts before installation.
4. Remove -g unless global installation is strictly required. Prefer a project-local or isolated installation.
5. Use npx --ignore-existing or the package manager's equivalent integrity controls as appropriate, while recognizing that this does not replace version pinning.
6. Document the exact expected source, package version, repository commit, and integrity value.
7. Recommend that users inspect fetched package contents and lifecycle scripts before execution.
8. Run installation in a restricted environment without administrative privileges or unnecessary access to credentials and sensitive files.
9. Add automated dependency monitoring and periodically re-audit pinned releases before updating them.

other

Note

• Location: SKILL.md:517

Finding

Pre-Selected Consent for Marketing Emails

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 517
Vulnerability Type: other: Privacy and Consent Risk
Risk Level: Low

Vulnerable Code

markdown

- **Checkout opt-in:** Pre-checked "Email me about new products"

Technical Analysis

The skill recommends presenting the marketing-email option as pre-checked during checkout. A pre-selected checkbox does not necessarily represent a freely given, specific, informed, and unambiguous affirmative action by the customer.

If a merchant implements this recommendation without jurisdiction-specific controls, customers may be enrolled in promotional email campaigns merely because they failed to notice or clear the checkbox. This can conflict with applicable privacy, electronic-marketing, and consent requirements. It can also undermine the reliability of consent records and increase spam complaints.

This issue does not provide system privileges or code execution. It is a privacy, compliance, and user-autonomy risk caused by unsafe default guidance.

Attack Path

1. A merchant uses the skill's list-growth guidance to configure the checkout process.
2. The marketing-email checkbox is enabled by default.
3. A customer completes checkout without noticing or clearing the checkbox.
4. The customer's email address is added to a marketing list despite the absence of an explicit affirmative selection.
5. Automated campaigns send promotional messages to that address.
6. The customer may submit complaints, unsubscribe, or allege that valid consent was not obtained.

Impact Assessment

The affected data is primarily customers' email addresses and associated subscription or purchase metadata. The scope includes customers exposed to the pre-selected checkout option and any marketing systems receiving those records.

Potential consequences include unsolicited marketing, inaccurate consent records, increased spam complaints, reduced sender reputation, regulatory scrutiny, legal costs, and reputat ...[truncated 140 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the pre-checked option with an unchecked checkbox requiring an affirmative customer action.
2. Use clear language that distinguishes transactional messages from optional promotional marketing.
3. Do not make marketing consent a condition of completing a purchase unless a valid legal basis and applicable requirements permit it.
4. Record the consent timestamp, collection source, notice text, policy version, jurisdiction, and relevant technical evidence.
5. Implement double opt-in where legally required or operationally appropriate.
6. Provide simple unsubscribe and preference-management controls in every marketing message.
7. Apply jurisdiction-specific rules based on the customer's location and obtain qualified legal review where necessary.
8. Ensure that withdrawal of consent is promptly synchronized across all connected email service providers and customer-data systems.
9. Update the skill instructions to warn merchants that consent requirements vary by jurisdiction and that checkout defaults must be validated before deployment.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The install command uses npx skills without pinning a specific package version, so users may execute whatever version is current at install time. This creates a supply-chain risk: a compromised, malicious, or breaking upstream release could be pulled automatically and run in the user's environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The statement that the skill 'activates automatically' based on a broad description can cause over-triggering in unrelated conversations, increasing the chance that the skill requests business details or steers outputs when the user did not intend to use it. While not code execution, ambiguous auto-activation expands attack surface for prompt-routing abuse and unintended data collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance recommends a pre-checked marketing opt-in but omits any warning that this may violate consent requirements and privacy laws in many jurisdictions. Users may implement unlawful consent collection, exposing them to regulatory penalties, complaints, and downstream misuse of marketing data gathered without valid permission.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Pre-checked email opt-in encourages collecting marketing consent without a clear affirmative action from the user. This undermines valid consent, can lead to unauthorized email marketing, and may expose both merchants and recipients to privacy harm, spam, and compliance violations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command references npx skills without a pinned version in the 'Other Skills' section, carrying the same supply-chain exposure as the primary install path. Even secondary examples can be copied by users and cause execution of unreviewed upstream code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The alternate installation example again uses an unpinned npx skills invocation, which allows whatever package version is available at execution time to run. In skill documentation, repeated unpinned commands increase the chance that users follow an unsafe install path.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes generating email automations, copy, ESP setup instructions, segmentation, and campaign calendars. Asking for competitors to reference expands into competitive analysis/benchmarking, which is not declared as part of the skill's purpose and is not necessary to produce the promised deliverables.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.