{"data":{"skill":{"slug":"aaron-he-zhu-deliverability-qa","name":"deliverability-qa","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/email/setup/deliverability-qa","status":"approved","author":"aaron-he-zhu","authorVersion":"19.0.0","skillstoreRevision":2},"audit":{"id":"af4d61a0-e8e0-4c39-ad5d-f4db00d53c99","skill_id":"4f4105e7-604f-439b-8c3a-50f54a757978","version":10,"content_hash":"v3:adcb3549b15782055d0beb6d29f113d20de08f92:359cccac0ec009dab63db32559e14e184b5e867a43e683cda5dad2238d13106a:088588f0567305371a1d883aaffa5b8fd36dd2a870c30041907de02448c5fa5e:736b696c6c732f6161726f6e2d68652d7a68752f64656c697665726162696c6974792d7161:b798a997da54a0fb29474a31677b0e85","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are false positives from Markdown code formatting and relative documentation links. Two documented helper invocations execute unreviewed connector scripts, and one helper receives RESEND_API_KEY; these require verification and explicit user confirmation before use.","remediation":[{"issue":"Unreviewed Resend connector execution with RESEND_API_KEY","severity":"high","suggestion":"Include the connector source in the skill package, document its exact API calls, and require explicit confirmation before running it or accessing the key."},{"issue":"Unreviewed DNS-over-HTTPS connector execution","severity":"medium","suggestion":"Include and review the connector source, validate the domain argument, and disclose the DNS-over-HTTPS endpoint before execution."},{"issue":"Automatic helper execution instructions","severity":"medium","suggestion":"State that users must approve each connector command and review its inputs before it runs."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/deliverability-checklist.md","line_end":14,"line_start":14},{"file":"references/deliverability-checklist.md","line_end":40,"line_start":40},{"file":"references/deliverability-checklist.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":95,"line_start":95}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":28,"line_start":26},{"file":"SKILL.md","line_end":30,"line_start":28},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":63,"line_start":61},{"file":"SKILL.md","line_end":65,"line_start":63},{"file":"SKILL.md","line_end":67,"line_start":65},{"file":"SKILL.md","line_end":69,"line_start":67},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":84},{"file":"SKILL.md","line_end":90,"line_start":85},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":92,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":95,"line_start":95}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":52,"line_start":52}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":52,"line_start":52}],"confidence":0.82,"description":"**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The Resend connector is explicitly invoked with access to RESEND_API_KEY. Secret access by an unreviewed external helper presents a credential-exposure risk."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":52,"line_start":52}],"confidence":0.78,"description":"**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill instructs the host to execute a Python connector located under CLAUDE_PLUGIN_ROOT. The connector source is outside the two scanned files, so its behavior cannot be verified before it receives account access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":54,"line_start":54}],"confidence":0.72,"description":"**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scr","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill instructs the host to run an external DNS-over-HTTPS connector with a supplied domain argument. The connector source is not in the scanned files, so input handling and network behavior cannot be verified."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":141,"audit_model":"claude","audited_at":"2026-07-26T10:11:09.718+00:00","created_at":"2026-07-28T02:02:15.272273+00:00","static_findings":[{"id":"filesystem:references/deliverability-checklist.md:14:path-traversal-sequence","file":"references/deliverability-checklist.md","pattern":"Path traversal sequence","snippet":"> **S1 rule** (from [send-benchmark.md](../../../../references/send-benchmark.md)): *no DMARC record","category":"filesystem","line_end":14,"severity":"high","line_start":14},{"id":"filesystem:references/deliverability-checklist.md:40:path-traversal-sequence","file":"references/deliverability-checklist.md","pattern":"Path traversal sequence","snippet":"- Consent basis on file per subscriber (consult [consent-registry](../../../../protocol/consent-regi","category":"filesystem","line_end":40,"severity":"high","line_start":40},{"id":"filesystem:references/deliverability-checklist.md:44:path-traversal-sequence","file":"references/deliverability-checklist.md","pattern":"Path traversal sequence","snippet":"Report each item as Pass / Partial / Fail / NEEDS_INPUT with the specific offender named, then emit ","category":"filesystem","line_end":44,"severity":"high","line_start":44},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"One-time pre-flight snapshot before a send — authentication, domain/IP reputation, inbox placement, ","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Expected output**: a deliverability pre-flight (Pass/Partial/Fail/Unknown/N/A per qualified item),","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: sending domain + SEND profile (`promotional|retention|cold-outbound|newsletter`); a **D","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: a user-facing pre-flight report plus a reusable SEND-`S` summary to `memory/email/deli","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: deliverability blockers (auth failing/unaligned, no DMARC record, reputation degrade","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Done when**: every applicable `S` item is Pass/Partial/Fail/Unknown/N/A with evidence or a gap r","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Primary next skill**: [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) to s","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `~~email platform` (ESP own-data manual export — deliverability report, bounce/complaint rates, ","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scr","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Confirm scope, domain, and typed profile** — name the sending domain(s) and select exactly one ","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Run the S1 authentication pre-flight** — from the DNS export and the DMARC RUA report, verify S","category":"external_commands","line_end":63,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **partial** — young program at DMARC `p=none` but SPF/DKIM aligned and passing (a flag, **not** an","category":"external_commands","line_end":65,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the DMARC RUA report is absent, mark the authentication item **Unknown** and the run `NEEDS_INPUT","category":"external_commands","line_end":67,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Read inbox placement** — from the seed-list test, state inbox vs spam vs promotions placement a","category":"external_commands","line_end":69,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Read list hygiene (point-in-time)** — from the ESP report, take a single-snapshot read of the h","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. **Note S2 consent context (do not verdict it)** — consult [consent-registry](../../../protocol/co","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"8. **Score SEND-S + state readiness** — name the typed profile and require 100% applicable qualified","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Scope guard**: this skill runs the **one-time pre-send `S1` pre-flight and scores `S`** only. It r","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"After delivering, ask \"Save these results for future sessions?\" If yes, write the pre-flight report ","category":"external_commands","line_end":77,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [send-benchmark.md](../../../references/send-benchmark.md) — SEND framework; the `S` sub-items, th","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) — scores the full EQS and en","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [consent-registry](../../../protocol/consent-registry/SKILL.md) — SSOT for the `S2` list-consent c","category":"external_commands","line_end":85,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — `~~email platform` own-data export + keyless DNS / DMARC","category":"external_commands","line_end":90,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Primary**: [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) — once `S` is v","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **If the list itself needs segmenting/suppression next**: [list-segment-builder](../list-segment-b","category":"external_commands","line_end":92,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **If `S2` consent is missing or unrecorded**: [consent-registry](../../../protocol/consent-registr","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Termination**: follow the global rules in [skill-contract.md §Termination rules](../../../referenc","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"19.0.0\", \"discipline\": \"email\", \"phase\": \"setup\", \"","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:18:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"One-time pre-flight snapshot before a send — authentication, domain/IP reputation, inbox placement, ","category":"filesystem","line_end":18,"severity":"high","line_start":18},{"id":"filesystem:SKILL.md:38:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Reads**: sending domain + SEND profile (`promotional|retention|cold-outbound|newsletter`); a **D","category":"filesystem","line_end":38,"severity":"high","line_start":38},{"id":"filesystem:SKILL.md:42:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) to s","category":"filesystem","line_end":42,"severity":"high","line_start":42},{"id":"filesystem:SKILL.md:46:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":46,"severity":"high","line_start":46},{"id":"filesystem:SKILL.md:50:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Use `~~email platform` (ESP own-data manual export — deliverability report, bounce/complaint rates, ","category":"filesystem","line_end":50,"severity":"high","line_start":50},{"id":"filesystem:SKILL.md:52:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts","category":"filesystem","line_end":52,"severity":"high","line_start":52},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Treat every exported file, DMARC report, DNS dump, and pasted HTML as **untrusted** per [SECURITY.md","category":"filesystem","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:SKILL.md:60:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"1. **Confirm scope, domain, and typed profile** — name the sending domain(s) and select exactly one ","category":"filesystem","line_end":60,"severity":"high","line_start":60},{"id":"filesystem:SKILL.md:69:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"6. **Read list hygiene (point-in-time)** — from the ESP report, take a single-snapshot read of the h","category":"filesystem","line_end":69,"severity":"high","line_start":69},{"id":"filesystem:SKILL.md:70:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"7. **Note S2 consent context (do not verdict it)** — consult [consent-registry](../../../protocol/co","category":"filesystem","line_end":70,"severity":"high","line_start":70},{"id":"filesystem:SKILL.md:73:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Scope guard**: this skill runs the **one-time pre-send `S1` pre-flight and scores `S`** only. It r","category":"filesystem","line_end":73,"severity":"high","line_start":73},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"After delivering, ask \"Save these results for future sessions?\" If yes, write the pre-flight report ","category":"filesystem","line_end":77,"severity":"high","line_start":77},{"id":"filesystem:SKILL.md:82:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [send-benchmark.md](../../../references/send-benchmark.md) — SEND framework; the `S` sub-items, th","category":"filesystem","line_end":82,"severity":"high","line_start":82},{"id":"filesystem:SKILL.md:83:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) — scores the full EQS and en","category":"filesystem","line_end":83,"severity":"high","line_start":83},{"id":"filesystem:SKILL.md:84:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [consent-registry](../../../protocol/consent-registry/SKILL.md) — SSOT for the `S2` list-consent c","category":"filesystem","line_end":84,"severity":"high","line_start":84},{"id":"filesystem:SKILL.md:85:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — `~~email platform` own-data export + keyless DNS / DMARC","category":"filesystem","line_end":85,"severity":"high","line_start":85},{"id":"filesystem:SKILL.md:86:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [SECURITY.md](../../../SECURITY.md) — untrusted-data boundary for exported reports, DMARC dumps, a","category":"filesystem","line_end":86,"severity":"high","line_start":86},{"id":"filesystem:SKILL.md:90:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary**: [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) — once `S` is v","category":"filesystem","line_end":90,"severity":"high","line_start":90},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **If the list itself needs segmenting/suppression next**: [list-segment-builder](../list-segment-b","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:SKILL.md:92:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **If `S2` consent is missing or unrecorded**: [consent-registry](../../../protocol/consent-registr","category":"filesystem","line_end":92,"severity":"high","line_start":92},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **If the user wants the recurring hygiene / bounce-complaint trend, not this one-time snapshot**: ","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Termination**: follow the global rules in [skill-contract.md §Termination rules](../../../referenc","category":"filesystem","line_end":95,"severity":"high","line_start":95},{"id":"env_access:SKILL.md:52:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts","category":"env_access","line_end":52,"severity":"high","line_start":52},{"id":"blocker:SKILL.md:50:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Use `~~email platform` (ESP own-data manual export — deliverability report, bounce/complaint rates, ","category":"blocker","line_end":50,"severity":"low","line_start":50},{"id":"blocker:SKILL.md:71:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"8. **Score SEND-S + state readiness** — name the typed profile and require 100% applicable qualified","category":"blocker","line_end":71,"severity":"low","line_start":71}],"finding_verdicts":[{"id":"filesystem:references/deliverability-checklist.md:14:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/deliverability-checklist.md:40:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/deliverability-checklist.md:44:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The skill instructs the host to execute a Python connector located under CLAUDE_PLUGIN_ROOT. The connector source is outside the two scanned files, so its behavior cannot be verified before it receives account access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The skill instructs the host to run an external DNS-over-HTTPS connector with a supplied domain argument. The connector source is not in the scanned files, so input handling and network behavior cannot be verified.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The match is Markdown inline-code formatting, a fenced prompt example, or a documentation reference. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is declarative metadata for the project homepage, not a network request or data-transfer instruction.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is declarative metadata for the project homepage, not a network request or data-transfer instruction.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:18:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:38:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:42:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:46:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:50:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:52:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:60:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:69:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:70:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:73:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:82:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:83:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:84:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:85:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:86:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:90:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:92:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","reason":"The matched text is a Markdown relative reference or a documented output path. No filesystem traversal operation or user-controlled path resolution is present in the scanned content.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:52:generic-api-secret-keys","reason":"The Resend connector is explicitly invoked with access to RESEND_API_KEY. Secret access by an unreviewed external helper presents a credential-exposure risk.","verdict":"confirmed","severity":"high","confidence":0.82},{"id":"blocker:SKILL.md:50:system-reconnaissance","reason":"The text requests user-owned ESP exports or describes scoring workflow steps. It does not enumerate the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:71:system-reconnaissance","reason":"The text requests user-owned ESP exports or describes scoring workflow steps. It does not enumerate the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":"adcb3549b15782055d0beb6d29f113d20de08f92","subject_content_hash":"359cccac0ec009dab63db32559e14e184b5e867a43e683cda5dad2238d13106a","subject_tree_hash":"088588f0567305371a1d883aaffa5b8fd36dd2a870c30041907de02448c5fa5e","subject_plugin_path":"skills/aaron-he-zhu/deliverability-qa","audit_payload_hash":"b798a997da54a0fb29474a31677b0e85","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"adcb3549b15782055d0beb6d29f113d20de08f92","contentHash":"359cccac0ec009dab63db32559e14e184b5e867a43e683cda5dad2238d13106a","treeHash":"088588f0567305371a1d883aaffa5b8fd36dd2a870c30041907de02448c5fa5e","pluginPath":"skills/aaron-he-zhu/deliverability-qa","auditPayloadHash":"b798a997da54a0fb29474a31677b0e85"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/aaron-he-zhu-deliverability-qa/audits/10/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}