Sequenzy Email Marketing

ReviewAudited by ClawScan on May 15, 2026.

Overview

This instruction-only Sequenzy guide is coherent and purpose-aligned, but it can use real account credentials to change subscriber and email-marketing data, so users should verify scope before using it.

Install/use this only if you trust the Sequenzy CLI and the account credentials it will use. Prefer a scoped or revocable API key, confirm the target company, use filters or limits for subscriber queries, and require explicit confirmation before sending emails, scheduling campaigns, deleting templates/sequences, hard-removing subscribers, or creating API keys.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken command or wrong ID could unsubscribe or delete subscribers, alter customer-facing email content, schedule campaigns, or send emails to real recipients.

Why it was flagged

The skill gives the agent documented workflows that can mutate subscriber records, templates, campaigns, sequences, and send or schedule emails. This is aligned with the Sequenzy marketing purpose, but the actions are operationally high impact.

Skill content
subscribers `list`, `add`, `get`, and `remove` ... campaigns `list`, `get`, `create`, `update` ... `schedule`, and `test` ... sequences `list`, `get`, `create`, `update`, `enable`, `disable`, `delete`, and `cancel-enrollments` ... send one transactional email
Recommendation

Use the skill only for explicit Sequenzy tasks, inspect records first, confirm IDs/recipients/content/timing before mutations, and avoid hard delete or send/schedule actions unless the user clearly requested them.

What this means

The agent can perform Sequenzy actions under the user's account or API key, potentially across accessible companies.

Why it was flagged

The skill expects Sequenzy API credentials or locally stored auth and will act with the privileges those credentials grant. This is normal for the integration, but it is sensitive account authority.

Skill content
Set `SEQUENZY_API_KEY` in the environment ... stores the API key in `Bun.secrets` when available, otherwise in local config ... `SEQUENZY_API_KEY` overrides local keychain/config state
Recommendation

Prefer a least-privilege, revocable API key; specify `--company` when needed; avoid sharing broad personal keys; and use logout or key revocation after automation if appropriate.

What this means

If the local `sequenzy` command is missing, outdated, or not from the expected publisher, the agent may fail or perform actions through unverified tooling.

Why it was flagged

The reviewed package is instruction-only and does not include or pin the Sequenzy CLI it tells the agent to use, so trust depends on the user's existing external CLI/MCP setup rather than reviewed code in this artifact.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the installed Sequenzy CLI/MCP source and version before authorizing account-level actions.