mailgo-coldmail-marketing

Complete cold email campaign suite for Mailgo — verify recipients, claim free mailbox, generate & optimize content, create campaigns, manage lifecycle, and v...

Security Scan

The skill contains only a deprecation/migration notice that tells the agent to uninstall this package and install a different package from another owner — this is inconsistent with the advertised functionality and creates a supply-chain redirect risk.

Purpose & Capability

The skill name and description promise a full cold-email campaign suite, but the shipped SKILL.md contains no functionality, APIs, or usage instructions — only a migration notice to install a package from a different owner. That mismatch means the package does not deliver the advertised capability and instead redirects users elsewhere.

Instruction Scope

The runtime instruction explicitly tells the agent to run 'clawhub uninstall @cailumin/...' and 'clawhub install @leadsnaviDeveloper/...'. Those commands will fetch and install code from an external account without any verification steps. The instructions therefore instruct potentially impactful, networked operations outside the original skill's scope.

Install Mechanism

There is no formal install spec in the registry entry (instruction-only). The SKILL.md recommends using clawhub to install a different package — an implicit external install. That redirection is effectively an install mechanism but is not vetted here and could pull arbitrary code from the network.

Credentials

The skill requests no environment variables, credentials, or config paths. However, the suggested install of a differently-owned package could later request credentials; the migration instruction provides no details about required secrets or permissions for the new package.

Persistence & Privilege

The skill itself does not set always:true and is not privileged, but its instructions direct changing the agent's installed skills (uninstall/install), which affects the agent's persistent configuration. The migration silently hands persistence/authority to a different account without verification.

What to consider before installing

This skill does not implement the advertised cold-email features; it only tells you to replace it with a package from a different owner. Do not run the suggested 'clawhub install' command automatically. Instead: (1) Verify the new owner's identity and reputation on ClawHub; (2) Inspect the new package's SKILL.md and code before installing (look for required env vars, network calls, or install scripts); (3) Prefer manual installation in a controlled environment or sandbox; (4) If you must migrate, check whether the new package is signed or has release metadata and review its permissions; (5) If you don't trust the new owner, keep this package disabled or uninstall it. If you want, provide the ClawHub page or the full SKILL.md for the @leadsnaviDeveloper package and I can evaluate that before you install.

Skill Deprecation Notice

mailgo-coldmail-marketing

This skill has been migrated from @cailumin to @leadsnaviDeveloper on ClawHub.

The version under @cailumin is now deprecated and will no longer receive updates.

Please install the latest version from the new account:

clawhub uninstall @cailumin/mailgo-coldmail-marketing
clawhub install @leadsnaviDeveloper/mailgo-coldmail-marketing