Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Email Marketing

v1.0.1

Email marketing automation for campaigns, newsletters, and customer engagement. Use when creating email sequences, drip campaigns, promotional emails, or cus...

0· 280·1 current·1 all-time
byYinanping@yinanping-cpu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description match an email marketing tool. The included email_campaign.py implements local campaign, list, and template management which is coherent with the stated purpose. However SKILL.md advertises many integration scripts (sync_customers.py, abandoned_cart.py, post_purchase.py, campaign_stats.py, ab_test.py) and features (Taobao/Douyin sync, analytics) that are not present in the file manifest — this is an inconsistency.
!
Instruction Scope
SKILL.md instructs running multiple scripts and integration flows, but only scripts/email_campaign.py exists. The documented 'send' command in SKILL.md omits SMTP/API configuration; the included send_campaign implementation expects an smtp_config but the CLI entrypoint calls send_campaign with no configuration, which will raise an exception (smtp_config is None and the code uses smtp_config.get). The instructions reference reading/writing local lists, templates, and campaign JSON files (which the code does) and do not instruct contacting external endpoints — but the advertising of e-commerce sync and analytics without code means the runtime behavior is ambiguous.
Install Mechanism
No install spec (instruction-only skill with a packaged script). Nothing is downloaded or installed automatically, so there is low installer risk. The code is provided in the bundle (one Python script) so no network-based installer is present.
!
Credentials
The skill declares no required environment variables or credentials, yet the code is designed to send mail via SMTP (imports smtplib and expects smtp_config), which normally requires credentials or API keys. The absence of declared SMTP/SendGrid/AWS SES credentials is disproportionate to the stated functionality and may lead integrators to supply secrets ad-hoc or modify code — this is a coherency issue. Also SKILL.md's e-commerce sync implies external API credentials (Taobao/Douyin) but none are declared or provided.
Persistence & Privilege
The skill does not request always:true, does not declare system-wide config changes, and only reads/writes files in local directories (lists/, campaigns/, templates/). No elevated persistence privileges are requested.
What to consider before installing
This package looks like a simple local email campaign tool, but there are clear mismatches you should consider before installing: - Missing files: SKILL.md references many helper scripts (customer sync, abandoned-cart, analytics) that are not present. Expect incomplete functionality. - Sending will likely fail: the CLI call to send does not provide SMTP config; the code expects an smtp_config object. You will need to supply or modify code to provide SMTP credentials or integrate with an email API. - Secrets handling: because the skill does not declare any required credentials, you may be tempted to hard-code SMTP or API keys into files or environment variables — avoid doing this without reviewing the code and understanding where credentials are stored/transmitted. - Data storage: the script stores lists and campaigns under local folders (lists/, campaigns/) and writes CSV/JSON files there. If you run it, ensure you run in an isolated directory and verify file contents. - Compliance: templates include unsubscribe placeholders and mailing-address guidance; you still must ensure legal compliance yourself and confirm unsubscribe handling is implemented (the code does not send or process unsubscribe webhooks). Recommendations: inspect and test the email_campaign.py in a safe environment (use --dry-run), do not supply SMTP/API credentials until you confirm how they are used/stored, and ask the publisher for the missing integration scripts or an updated release that documents credential requirements. If you need full Taobao/Douyin integration or hosted sending, prefer a skill that explicitly declares the required credentials and provides the integration code.

Like a lobster shell, security has layers — review code before you run it.

latestvk9793k77mk4x634g3rxmbp3cgh82fsb7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments