Security audit

sequenzy-email-marketing

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious with medium confidence, chiefly because its documented capabilities extend well beyond the stated email-marketing purpose and the inspection was incomplete.

Consider whether you are comfortable installing a broad operations guide whose declared purpose is email marketing but whose documented features cover many other account and messaging functions. The verdict is suspicious, not malicious; several alerts concern documentation examples, but the scan was partial, so it cannot provide a complete safety assessment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (71)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is explicitly email-focused, whereas this chunk documents a separate push-notification and live-activity feature set. These are substantive communication capabilities involving device tokens and mobile-platform credentials, not merely implementation details supporting email workflows. The chunk is a command reference rather than evidence that these operations have actually executed, but the capabilities it exposes are not represented in the description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied commands manage geographic boundaries for stores, a capability not disclosed in the email-marketing description. Although they use the Sequenzy CLI, geofences are a distinct resource rather than a supporting implementation detail of the declared workflows. The chunk contains command examples; it does not demonstrate that they were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose covers email-marketing workflows but does not disclose SMS management, SMS sending, or SMS content generation. The supplied commands operate on a separate messaging channel and include configuration changes and outbound texting, which are substantive undeclared capabilities rather than supporting implementation details.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied command reference covers a push-notification import workflow, which is materially distinct from the declared email-marketing capabilities. Its use of provider-specific endpoints, application identifiers, API-key files, and device CSV data supports an undeclared push migration capability rather than merely implementing the listed email workflows. The chunk contains command examples; it does not demonstrate that any import was actually executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied command reference covers commerce product and digital-file management, which the declared description does not include. These are distinct user-facing capabilities rather than supporting implementation details of the listed email-marketing workflows. The chunk documents commands; it does not establish that they were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied chunk is a command reference rather than an executable script, but its documented capabilities materially extend beyond the declared email-marketing scope. Every command targets the in-app messaging subsystem. Although campaign management, content generation, and statistics overlap conceptually with the description, displaying and controlling messages inside an application is a distinct delivery channel and user-interface capability that the description does not declare.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied commands concern in-app content placements rather than the declared email-marketing workflows. Placement management and user-specific in-app content retrieval are distinct capabilities not disclosed in the description, rather than supporting implementation details of the listed email operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied chunk documents a distinct data-export capability that the description does not disclose. Configuring external storage destinations and running bulk or recurring exports is more than an implementation detail of the listed subscriber-management or statistics-reading operations. These are command examples, not evidence that any export has actually executed, but the capability they expose is undeclared.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied chunk documents landing-page and domain-management capabilities that the declared description does not identify. These are distinct user-facing operations, not merely implementation details supporting the listed email workflows. The chunk contains command examples; it does not establish that any commands were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Advertising audience synchronization is a distinct capability not disclosed in the declared email-marketing workflows. Although subscriber segments are mentioned, using those segments to populate advertising accounts introduces an additional destination and operational purpose beyond managing email-marketing segments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The chunk is a command reference rather than an executing script, but it exposes integration administration capabilities not declared in the description. Although list/tag mappings overlap with subscriber organization, connecting external providers, controlling synchronization, and enabling tracking pixels are distinct capabilities beyond the stated email-marketing operations and outbound webhook management.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied chunk documents popup-management functionality, which the declared description does not mention. Although popups can support email marketing and subscriber acquisition, managing interactive popup resources is a distinct capability rather than an implementation detail of the listed workflows. The chunk contains command examples; it does not establish that those commands were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The email, sequence, and subject-line generation commands align with the description. The SMS generation command introduces a separate messaging-channel capability that is not declared. The snippet does not show SMS sending or other unrelated actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied commands cover domain and DNS administration, capabilities not declared in the description. Although related to email delivery, configuring sending and tracking domains and upgrading DNS are distinct administrative operations rather than merely supporting implementation details of the listed campaign and messaging workflows. The snippet documents these operations; it does not establish that they were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Warehouse integration and synchronization management are substantive capabilities not disclosed in the declared description. Although synchronized data can support subscriber management, configuring external databases and executing warehouse queries crosses a distinct resource and capability boundary rather than merely implementing an ordinary email-marketing operation. The supplied chunk is a command reference, so it demonstrates documented capabilities rather than proving that any commands were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Receiving-domain administration is not declared. Although related to email operations, configuring and removing inbound-email domains is a distinct administrative capability from triaging or replying to inbox conversations. The supplied chunk therefore exposes an undeclared capability rather than merely an implementation detail of a listed workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description covers extensive email-marketing operations and capability discovery but does not disclose submitting product feedback or bug reports. The supplied commands create feedback submissions rather than inspect support or perform the listed marketing workflows. This is an additional reporting capability, not merely an implementation detail of a declared operation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description includes authenticating but does not declare administering API credentials or their permissions. Creating scoped credentials and revoking keys are distinct security-management capabilities, not merely implementation details of signing in. The supplied chunk documents these operations rather than executing them.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: These commands configure ecommerce-specific automation settings. Although related to email marketing, Shopify integration management and its automation controls are not disclosed in the declared capabilities and are distinct from supporting implementation details for the listed workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: Although related to Sequenzy, account notification preference management is not among the declared workflows. The settings command changes account-level alert behavior rather than managing subscribers or campaign lifecycles, so it represents an undeclared capability rather than merely an implementation detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The commands concern signup-form management, a distinct capability not identified in the declared description. Although forms support email marketing and can connect to declared list/tag operations, changing form content, bot protection, and resubscription settings goes beyond supporting implementation details for those operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: Synchronization-rule management is a distinct administrative capability not identified in the declared workflow list. These commands directly expose that capability rather than merely providing implementation details for a declared operation. The chunk documents commands; it does not establish that they were executed.
Content: No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
For MCP tool effect annotations and feedback attribution, read [MCP effect disclosures](references/use-cases.md#mcp-effect-disclosures).

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
Read [references/use-cases.md](references/use-cases.md) before executing anything non-trivial. The currently implemented CLI flows are:

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
edit the returned markdown, and save with its version. See [design.md workflow](references/use-cases.md#designmd).