Habilidades lifecycle-email

📦

lifecycle-email

Name: lifecycle-email
Author: cmj-hub

Revisión del contenido r1 Riesgo medio 🌐 Acceso a red⚙️ Comandos externos📁 Acceso al sistema de archivos🔑 Variables de entorno⚡ Contiene scripts

Draft and Validate Opt-In Email Sequences

Generic follow-up emails can overlook the resource subscribers requested and the problem they described. This skill structures a three-part sequence and checks drafts locally.

Compatible con: Claude Codex Code(CC)

⚠️ 50 Deficiente

Maintain this Skill? Claim it ⚠️ 50 Deficiente

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "lifecycle-email" from https://skillstore.io/skills/cmj-hub-lifecycle-email.md and its manifest at https://skillstore.io/api/skills/cmj-hub-lifecycle-email/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/cmj-hub-lifecycle-email.md Manifest firmado GET /api/skills/cmj-hub-lifecycle-email/manifest Lockfile firmado GET /api/skills/cmj-hub-lifecycle-email/lockfile

Pruébalo

Usando "lifecycle-email". An opted-in trial user requested a checklist. Their problem is: the trial dies after the first login.

Resultado esperado:

Welcome: You asked for the trial checklist. Thank you for signing up.
Bargain: Your requested trial checklist is available at [resource link].
Nurture: You said the trial dies after the first login. Which step prevents users from returning?

Usando "lifecycle-email". A draft contains a day 1 tip series and does not repeat the stated problem in nurture.

Resultado esperado:

Validation refused the draft. Replace the generic series with problem-specific follow-up and include the complete stated pain phrase.

Usando "lifecycle-email". A supplied draft contains incomplete JSON.

Resultado esperado:

Input validation failed with an invalid JSON error. The scorer does not print the malformed draft.

Auditoría de seguridad

Riesgo medio

v1 • 3/10/2026 Abrir el informe versionado

Most static findings are false positives involving template literals, CSS, documentation, byte-order-mark handling, and legitimate local commands. The optional asset renderers contain HTML injection risks, external font requests, and destructive cleanup of a predictable directory. No evidence found of credential theft, malicious exfiltration, or prompt injection.

Archivos escaneados

711

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Medio

assets/card.mjs:16-17 assets/card.mjs:36-37 assets/demo.mjs:11-15 assets/demo.mjs:25-26 assets/demo.mjs:67-68

Untrusted specification can terminate renderer HTML blocks

Both renderers interpolate accent_color directly into style blocks. The demo embeds JSON.stringify(s) directly into a script block without escaping HTML delimiters. A crafted specification can terminate either block and introduce executable browser content before any innerHTML assignment.

The source directly inserts unvalidated strings into HTML style and script contexts. JSON serialization does not escape HTML closing tags; exploitation requires rendering an untrusted specification.

Medio

assets/demo.mjs:100-102 assets/demo.mjs:119

Demo renderer deletes preexisting output-derived directories

The demo recursively deletes outGif plus the .frames suffix before creating its frame directory. It checks neither directory ownership nor prior contents. Selecting an output path can therefore erase an unrelated existing directory, and final cleanup repeats the recursive deletion.

rmSync uses recursive and force options on a predictable path derived from the caller's output argument. No exclusive temporary-directory creation or ownership check precedes deletion.

Elementos de revisión de capacidades (6)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into h without escaping. Assigning h to innerHTML allows attacker-controlled HTML and event handlers.

Medio

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines enter innerHTML without escaping. Rendering an untrusted specification can execute injected browser code.

Bajo

assets/card.mjs:22

Hardcoded URL

The generated page requests a preconnection to Google Fonts during rendering. This creates external network contact outside the offline scorer.

Bajo

assets/card.mjs:23

Hardcoded URL

The generated page preconnects to Google's font asset host. Rendering can expose connection metadata to an external service.

Bajo

assets/card.mjs:24

Hardcoded URL

The stylesheet link loads Google Fonts while Chrome renders local assets. It exposes request metadata and prevents fully offline rendering.

Bajo

assets/demo.mjs:16

Hardcoded URL

The demo page loads a Google Fonts stylesheet in the browser. This exposes request metadata and introduces an external rendering dependency.

Factores de riesgo

🌐 Acceso a red (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:35

⚙️ Comandos externos (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:31 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:52-59 tests/test_score.py:14

📁 Acceso al sistema de archivos (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Variables de entorno (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Contiene scripts (2)

assets/demo.mjs:90 assets/demo.mjs:91

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg)](https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/cmj-hub-lifecycle-email.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

cmj-hub. (2026). lifecycle-email security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1

Cita BibTeX

@techreport{cmj-hub-cmj-hub-lifecycle-email-2026,
  author = {cmj-hub},
  title = {lifecycle-email security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lifecycle-email security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-lifecycle-email:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Follow up after a resource request

Draft a welcome, deliver the requested checklist, and write follow-up copy addressing the subscriber's stated problem.

Support trial onboarding

Create an opt-in trial sequence focused on a specific onboarding problem, then check that all three sections are present.

Review client email drafts

Check client-provided drafts for missing sections, blocked phrases, and absent problem references before manual editorial review.

Prueba estos prompts

Draft a first sequence

Draft an opt-in sequence for subscribers who requested [resource]. Their stated problem is [pain]. Include welcome, bargain, and nurture sections.

Improve an existing draft

Review [draft] for subscribers who opted in for [resource]. Separate welcome, bargain, and nurture. Keep the full pain phrase [pain] in nurture.

Validate a local draft

Check [draft_path] with scripts/score.py. Explain any refusal or input error and propose corrections. Do not send emails or run asset renderers.

Compare audience-specific sequences

Draft sequences for [audiences] using their documented consent, promised resources, and exact pain phrases. Validate each and compare messaging. Flag unsupported claims for review.

Mejores prácticas

Confirm subscriber consent and identify the exact resource promised before drafting.
Use the complete stated problem phrase in nurture, then review the copy for clarity and accuracy.
Run local validation on minimized drafts and manually review consent, links, claims, and delivery before sending.

Evitar

Do not use this opt-in framework for unsolicited outreach.
Do not replace problem-specific nurture with a generic calendar of tips.
Do not treat a passing score as proof of consent, legal compliance, actual resource delivery, or campaign performance.

Preguntas frecuentes

Does this skill send email?

No. It guides drafting and validates text. Sending and scheduling require your email platform.

What does bargain mean here?

Bargain is the section that delivers the resource or access promised when the subscriber opted in.

What does the scorer require?

It requires four nonempty text fields: pain, welcome, bargain, and nurture. Nurture must contain the full pain phrase, ignoring case.

Why can a reasonable draft fail?

Configured phrase matches can reject otherwise reasonable copy. A paraphrased pain phrase also fails because matching requires the complete phrase.

Does validation need network access or paid APIs?

The Python scorer uses only the standard library and makes no network requests. Optional asset rendering loads external fonts.

Are the optional renderers safe for untrusted specifications?

No. They contain HTML injection risks, and the demo deletes a predictable frame directory. Avoid untrusted specifications and unnecessary renderer execution.