Sequenzy

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:34 PM UTC
• Version: 1.6.0

Overview

The skill is mostly a disclosed Sequenzy admin guide, but it tells agents to perform some authenticated actions without fresh user control, including automatic feedback submission and immediate campaign cancellation.

Install only if you are comfortable giving the agent access to authenticated Sequenzy admin workflows. Before using it, require explicit confirmation for destructive or operationally significant actions such as cancel, delete, revoke, replay, schedule, team invites, API-key creation, and webhook changes. Do not allow automatic feedback submission unless you approve the exact message and any context being sent to Sequenzy.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:68

Finding

Mandatory Unconsented Transmission of User Context to the Sequenzy Team

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:68-76
• references/command-reference.md:1122-1138
• references/command-reference.md:1156
• references/use-cases.md:674-688

Vulnerability Type: Automatic external disclosure and task-goal redirection
Risk Level: High

Vulnerable Code Snippets

SKILL.md:68-76:

markdown

## Unsupported Or Placeholder Workflows

Treat missing subcommands as unsupported even when the noun exists. The main remaining gaps: campaign immediate send (no "send now" command - schedule with a near-future `--at` timestamp instead), sending domain add/verify (MCP `add_sending_domain` / `verify_sending_domain` or dashboard only), form creation and embed snippets (MCP `create_form` / `get_form_embed` only), and image asset upload (MCP `upload_image_asset` only). Bulk list population is supported through `sequenzy lists add-subscribers` and its `sequenzy lists import` alias, not through `subscribers add`. Whenever the user wanted something unsupported, report the gap with `sequenzy feedback "..." --category missing_capability` (MCP: `submit_feedback`) so it reaches the Sequenzy team.

## Execution Pattern

1. Check auth first with `sequenzy whoami` or by verifying `SEQUENZY_API_KEY` is set.
2. Pick the narrowest command that matches the use case.
3. Validate IDs, recipient email, subject, template, or content input before issuing a mutation.
4. Surface CLI limitations directly instead of inventing a workaround.
5. If the workflow is unsupported in the CLI, say whether the next-best path is the Sequenzy dashboard or direct API use, and report the gap with `sequenzy feedback "..." --category missing_capability` (MCP: `submit_feedback`).

references/command-reference.md:1122-1138:

markdown

## Feedback

```bash
sequenzy feedback "No command to bulk-delete campaigns by label" --category missing_capability
sequenzy feedback "Segment count and list output disagree 
...[truncated 5283 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory language such as “always send” and “whenever,” and make feedback submission optional.

2. Default to reporting unsupported functionality only in the local response to the user.

3. Before any feedback submission, clearly identify:

   • The external destination.
   • The exact message and context fields.
   • The fact that the operation is authenticated and cannot be retracted through the documented interface.

4. Require explicit, task-specific user approval immediately before calling sequenzy feedback or submit_feedback.

5. Do not infer consent merely because the user asked about unsupported functionality.

6. Apply data minimization by removing subscriber data, email addresses, company identifiers, campaign IDs, sequence IDs, internal URLs, incident details, and unrelated conversation context.

7. Continue prohibiting API keys, credentials, access tokens, and webhook secrets, but extend the prohibition to all confidential or personally identifiable information.

8. Provide a preview-and-confirm flow, for example:

   text

   This workflow is unsupported. Would you like me to send the following
   redacted feedback to the Sequenzy team?
   
   Category: missing_capability
   Message: [exact proposed message]
   Context: [exact proposed context]
   

9. If the user declines or does not explicitly approve, do not make the network request.

10. Where possible, return a submission identifier and document retention, deletion, and support-based retraction procedures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

Read [references/use-cases.md](references/use-cases.md) before executing anything non-trivial. The currently implemented CLI flows are:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

Read [references/use-cases.md](references/use-cases.md) before executing anything non-trivial. The currently implemented CLI flows are:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

- [references/command-reference.md](references/command-reference.md): exact command shapes, env vars, behavior, and caveats.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 238)May include surrounding context.

md

Behavior:

- without `--hard`, sends `PATCH /api/v1/subscribers/:email` with `{ status: "unsubscribed" }`
- with `--hard`, sends `DELETE /api/v1/subscribers/:email`
- `--external-id <id>` addresses the subscriber by customer-owned ID
- supports `--company` and `--json`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 271)May include surrounding context.

md

Behavior:

- `notes list`: `GET /api/v1/subscribers/:email/notes`; `notes add`: `POST /api/v1/subscribers/:email/notes`; `notes delete`: `DELETE /api/v1/subscribers/notes/:noteId`
- `--external-id` addresses the subscriber by customer-owned ID
- MCP parity: `list_subscriber_notes`, `add_subscriber_note`, and `delete_subscriber_note`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 431)May include surrounding context.

md

- `lists create`: `POST /api/v1/lists`
- create body shape is `{ name, description, isPrivate }`
- `lists update`: `PATCH /api/v1/lists/:listId` with at least one of `--name`, `--description`, `--private`, or `--no-private`
- `lists delete`: `DELETE /api/v1/lists/:listId`; removes the list and all of its memberships, reports `removedMemberships`, and keeps the subscribers themselves
- `lists add-subscribers` and `lists import`: `POST /api/v1/lists/:listId/subscribers`
- `lists remove-subscribers`: `POST /api/v1/lists/:listId/subscribers/remove`
- add-subscribers body shape is `{ emails, duplicateStrategy, enrollInSequences, optInMode }`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 457)May include surrounding context.

md

- `tags list`: `GET /api/v1/tags`; bare `sequenzy tags` without a subcommand still lists tag definitions for backwards compatibility
- `tags create`: `POST /api/v1/tags` with `{ name, color? }`
- `tags update`: `PATCH /api/v1/tags/:tagId` with `{ color }` (`--color` is required)
- `tags delete`: `DELETE /api/v1/tags/:tagId`
- tag names are normalized to lowercase with dashes, so `VIP Customer` becomes `vip-customer`
- the color defaults to `gray`; valid colors are `gray`, `red`, `orange`, `amber`, `yellow`, `lime`, `green`, `emerald`, `teal`, `cyan`, `sky`, `blue`, `indigo`, `violet`, `purple`, `fuchsia`, `pink`, and `rose`
- system tags cannot be updated or deleted

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 486)May include surrounding context.

md

- `segments count`: `GET /api/v1/segments/:id/count`
- `segments create`: `POST /api/v1/segments`
- `segments update`: `PATCH /api/v1/segments/:segmentId` with at least one of `--name`, `--filters-json`, `--filters-file`, or `--join-operator and|or`
- `segments delete`: `DELETE /api/v1/segments/:segmentId`; prompts for confirmation, `--yes` skips
- update filters replace the existing filter set; `--filters-json`/`--filters-file` accept the same array or `root` object shapes as create, and missing filter IDs are filled in by the CLI
- `--filter-json` accepts either the legacy raw segment filter array or a nested filter `root` object
- `--match all|any` controls whether top-level filters are combined with `and` or `or`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 519)May include surrounding context.

md

- `products list`: `GET /api/v1/products`, optionally with `?provider=stripe|shopify|woocommerce|manual&search=...`; returns one page by default (100-per-request cap), pass `--all` to page through larger catalogs
- `products sync`: `POST /api/v1/products/sync`; queues a catalog sync (`--integration` selects one when several are connected) and returns 404 without an active integration
- `products upsert [productId]`: creates or updates API-provider products keyed by your own `productId`; supports `--title`, `--description`, `--price-cents`, `--currency`, `--image-url`, `--product-url`, `--in-stock`/`--out-of-stock`, `--provider-created-at`, and bulk `--products-json`/`--products-file` for up to 100 products; combine `--file` or `--url` with a single-product upsert to attach the deliverable in the same command
- `products delete <productId>`: `DELETE /api/v1/products/:id`
- `products attach-file --file`: `POST /api/v1/products/delivery/upload-url` for a presigned URL, PUTs the file bytes there, then `PUT /api/v1/products/:id/delivery` with `source: "upload"`
- `products attach-file --url`: `PUT /api/v1/products/:id/delivery` with `source: "url"`
- `products detach-file`: `DELETE /api/v1/products/:id/delivery`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 522)May include surrounding context.

md

- `products delete <productId>`: `DELETE /api/v1/products/:id`
- `products attach-file --file`: `POST /api/v1/products/delivery/upload-url` for a presigned URL, PUTs the file bytes there, then `PUT /api/v1/products/:id/delivery` with `source: "upload"`
- `products attach-file --url`: `PUT /api/v1/products/:id/delivery` with `source: "url"`
- `products detach-file`: `DELETE /api/v1/products/:id/delivery`
- MCP equivalents: `list_products`, `upsert_products`, `delete_product`, `attach_product_file` (URL attach only), `remove_product_file`, `sync_products`

Caveats:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 579)May include surrounding context.

md

- `templates render`: `GET /api/v1/templates/:id/render`; same personalization and output flags as `campaigns render` (see Campaigns)
- `templates localizations set <id> <locale>` stores caller-supplied localized content immediately; the locale must be enabled in the company's localization settings and cannot be the primary locale; provide exactly one HTML or blocks content source
- `templates localizations sync <id>` queues AI translation for selected `--locale` values, or every enabled non-primary locale when omitted
- `templates delete`: `DELETE /api/v1/templates/:id`
- MCP parity: `set_template_localization` and `sync_template_localizations`

Caveats:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 639)May include surrounding context.

md

- `campaigns unschedule`: returns a scheduled campaign (and any recurrence) to an editable draft; only scheduled campaigns can be unscheduled
- `campaigns pause`: `POST /api/v1/campaigns/:id/pause`
- `campaigns resume`: `POST /api/v1/campaigns/:id/resume`
- `campaigns delete`: `DELETE /api/v1/campaigns/:id`
- `campaigns duplicate`: `POST /api/v1/campaigns/:id/duplicate`
- `campaigns resend-to-non-openers`: `POST /api/v1/campaigns/:id/resend-to-non-openers`; available 6 hours after a sent campaign finishes, creates a draft targeting the same audience plus a "didn't open this campaign" rule, and estimates the non-opener count - review the draft, then schedule it
- dashboard-aware responses include `url`, campaign review `previewUrl`, and `appUrls` when the company can be resolved

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 722)May include surrounding context.

md

Behavior:

- CRUD maps to `GET/POST/PATCH/DELETE /api/v1/landing-pages[/:id]`, plus `/publish`, `/unpublish`, and `/duplicate` actions and `/api/v1/landing-pages/domain` for custom domains
- pages are created as drafts; publish only after reviewing. When `--content-json/-file` is omitted, a valid default page is generated from `--template`
- a duplicate is always a draft with its own slug, views, and conversions; without `--name` it is called "<original name> (copy)"
- custom domains require a CNAME record pointing to `pages.sequenzydns.com`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 772)May include surrounding context.

md

- `sequences archive` / `unarchive` hide or restore a sequence without deleting it (MCP: `archive_sequence`, `unarchive_sequence`)
- `sequences enrollments`: `GET /api/v1/sequences/:id/enrollments`; defaults to active and waiting enrollments, filters by `--status`, `--node-id`, `--subscriber-id`, and `--email`, and exports with `--all --csv <file>`. `waitUntil` is when a waiting enrollment resumes. Get node IDs from `sequences get` or `stats --sequence` (MCP: `list_sequence_enrollments`)
- `sequences pause-enrollments` stops new entrants while existing active and waiting recipients keep moving (the sequence must be active; use `disable` to freeze current recipients too); `resume-enrollments` reopens entry (MCP: `pause_sequence_enrollments`, `resume_sequence_enrollments`)
- `sequences delete`: `DELETE /api/v1/sequences/:id`
- `sequences enroll`: `POST /api/v1/sequences/:id/enroll`
- `sequences cancel-enrollments`: `POST /api/v1/sequences/:id/enrollments/cancel`
- dashboard-aware responses include `url` on sequence records and `appUrls` on the top-level JSON when the company can be resolved

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 842)May include surrounding context.

md

- `ab-tests update-variant`: `PATCH /api/v1/ab-tests/:id/variants/:variantId`
- `ab-tests create`: `POST /api/v1/ab-tests`
- `ab-tests add-variant`: `POST /api/v1/ab-tests/:id/variants`
- `ab-tests delete-variant`: `DELETE /api/v1/ab-tests/:id/variants/:variantId`
- `ab-tests delete`: `DELETE /api/v1/ab-tests/:id`

Caveats:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 843)May include surrounding context.

md

- `ab-tests create`: `POST /api/v1/ab-tests`
- `ab-tests add-variant`: `POST /api/v1/ab-tests/:id/variants`
- `ab-tests delete-variant`: `DELETE /api/v1/ab-tests/:id/variants/:variantId`
- `ab-tests delete`: `DELETE /api/v1/ab-tests/:id`

Caveats:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 898)May include surrounding context.

md

- `team list`: `GET /api/v1/team`; returns the owner, members, and pending or expired invitations
- `team invite`: `POST /api/v1/team/invitations` with `{ email, role, canManageBilling? }`
- `team cancel-invitation`: `DELETE /api/v1/team/invitations/:invitationId`

Caveats:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/command-reference.md (reported line 959)May include surrounding context.

md

- `webhooks list`: `GET /api/v1/webhooks`
- `webhooks create`: `POST /api/v1/webhooks` with `{ name, url, events? }`
- `webhooks update`: `PATCH /api/v1/webhooks/:id` with at least one of `--name`, `--url`, `--event`, `--enable`, or `--disable`
- `webhooks delete`: `DELETE /api/v1/webhooks/:id`; this permanently deletes the endpoint and its delivery history
- `webhooks test`: `POST /api/v1/webhooks/:id/test`
- `webhooks deliveries`: `GET /api/v1/webhooks/:id/deliveries`, optionally with `?limit=` (1-100)
- `webhooks replay`: `POST /api/v1/webhooks/:id/deliveries/:deliveryId/replay`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/command-reference.md (reported line 1016)May include surrounding context.

md

- `catalog`: `GET /api/v1/integrations/catalog`; works whether or not the provider is connected - its `connectFields` list what a provider needs, and its events are the ones sequences can trigger on
- `connect`: `POST /api/v1/integrations/connect`; covers API-key / webhook-secret providers (Polar, Paddle, Dodo, Whop, Creem, Chargebee, Clerk, PostHog, Affonso). OAuth and app-install providers (Stripe, Shopify, Supabase, GitHub, WooCommerce) connect and disconnect in the dashboard only. Reconnecting replaces stored credentials, and the response includes the webhook URL to configure at the provider
- pass secrets via environment variables instead of flags to keep them out of shell history; credentials, access tokens, and webhook secrets are never returned by read commands
- `list` / `get`: connected integrations and one integration's detail - `get` lists every event the provider emits, the tags each applies through sync rules, and which sequences trigger on it
- `activity`: `GET /api/v1/integrations/activity`; retained for 24 hours - use `--status failed` when an integration reports connected but contacts are not appearing
- `sync <id>` queues a catalog/backfill re-sync (Stripe, Polar, Paddle, Dodo, Creem, Chargebee, Whop); returns immediately, poll `integrations get` to watch `syncStatus`; fails with a conflict if a sync is already running

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance explicitly instructs the agent to perform an irreversible campaign cancellation immediately and only ask questions afterward. That removes an important human-confirmation safeguard for a destructive action, creating a real risk of unauthorized or mistaken cancellation of scheduled or live email sends with business and customer impact.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description and overview say to use this skill for 'broad Sequenzy references' and whenever the user 'refers broadly to Sequenzy and no narrower skill is obviously better.' Those activation conditions are subjective and do not provide clear trigger boundaries or negative examples, which can lead to overlap with other Sequenzy-related skills.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill documents high-impact mutating operations such as campaign cancel/pause/resume/delete and notes that at least one of them executes immediately with no confirmation prompt. In a generic skill intended for broad Sequenzy operations, this creates a real risk that an agent may autonomously perform destructive or business-critical actions without obtaining fresh user confirmation or performing sufficient preflight checks.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- segments `list`, `create`, `update`, `delete`, and `count`, including `--match any`, nested filter roots, custom event filters, and saved-segment composition filters
- templates `list`, `get`, `create`, `update`, and `delete`, with `list` supporting label filters and `create`/`update` accepting labels, raw HTML, or Sequenzy block JSON
- campaigns `list`, `get`, `create`, `update` including label and reply-to updates, `schedule`, and `test`, with `list` supporting label filters, `create` accepting labels plus raw HTML, Sequenzy block JSON, or prompt-generated content, `update` accepting labels plus raw HTML or Sequenzy block JSON, and `schedule` returning a review preview link; `create` and `schedule` both accept the audience via `--segment` or `--target-lists-json`/`--target-lists-file`
- campaign lifecycle control with `campaigns cancel` (stops scheduled, paused, waiting-approval, or sending campaigns immediately, no confirmation prompt), `campaigns unschedule` (returns a scheduled campaign or recurring series to draft), `campaigns pause` and `campaigns resume` for an active send (resume supports `--spread-over-hours`), `campaigns delete` (blocked while sending, scheduled, or paused - cancel first), and `campaigns duplicate` with `--mode campaign|ab_test|variant`
- campaign audience inspection with `campaigns audience`, true-to-send HTML previews with `campaigns render` / `templates render` / `sequences render` (subscriber or ad-hoc personalization, locale, tracking, `--out`), recurring sends with `campaigns schedule --repeat weekly|monthly`, and post-send re-engagement with `campaigns resend-to-non-openers`
- ab-tests `list`, `get`, `stats`, `restart`, `update-variant`, `create`, `add-variant`, `delete-variant`, and `delete`; create/add-variant/delete-variant/delete work on campaign A/B tests in draft status, variant A is the protected control, and `restart` reruns a finished sequence A/B test
- MCP template and campaign tools support labels on list/create/updat
...[truncated 25 chars]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill explicitly instructs agents to surface API keys and one-time webhook signing secrets, but it does not pair that with clear handling constraints such as masking in logs, limiting disclosure to the requesting user, and avoiding persistence in transcripts or tool output history. In an agent environment, this raises the risk of credential leakage through chat responses, debug logs, shared session history, or downstream tooling.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/command-reference.md (reported line 668)May include surrounding context.

md

- `campaigns get` now includes saved reply-to details when the campaign has a reply profile
- only draft campaigns can be updated through this API path
- there is no CLI command for immediate send; schedule with a near-future `--at` timestamp instead
- `cancel` works from scheduled, sending, paused, waiting_approval, and rejected statuses; it shows no confirmation prompt so a bad send can be stopped fast
- `pause` only works on a campaign in sending status; `resume` only works on a paused campaign
- `resume --spread-over-hours` accepts integers from 1 to 72 to spread the remaining delivery
- `delete` is blocked while the campaign is sending, scheduled, or paused; cancel it first

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

This is a true autonomous-decision issue because the skill authorizes the agent to choose and execute a permanent state-changing action without confirmation. In the context of email operations, canceling a campaign can halt revenue, disrupt customer communications, and cannot be cleanly undone, so the lack of confirmation materially increases operational risk.

Content

Scanner excerpt · references/use-cases.md (reported line 383)May include surrounding context.

md

- use `cancel` when the send should not continue at all; it is permanent and works from scheduled, sending, paused, waiting-approval, and rejected statuses
- use `pause` when the user wants to stop a send temporarily and may continue it; it only works while the campaign is in sending status
- use `resume` to continue a paused campaign, optionally spreading the remaining delivery with `--spread-over-hours` (1-72)
- `cancel` needs no `--yes` and shows no confirmation prompt, so it is the fastest way to stop a bad send; run it first and ask questions after when the user reports a mistake
- check `campaigns get` first when you are unsure of the current status; the API rejects transitions from the wrong status

MCP equivalents are `cancel_campaign`, `pause_campaign`, and `resume_campaign` (optional `spreadOverHours`).

Static analysis

No suspicious patterns detected.