📦

cold-offer

Name: cold-offer
Author: cmj-hub

Révision du contenu r1 Risque élevé 🌐 Accès réseau⚙️ Commandes externes📁 Accès au système de fichiers🔑 Variables d’environnement⚡ Contient des scripts

Draft Cold Offers Around Concrete Findings

Cold outreach often asks for a purchase before showing useful work. This skill structures a finding, a small solution sample, and a first email with local draft checks.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "cold-offer" from https://skillstore.io/skills/cmj-hub-cold-offer.md and its manifest at https://skillstore.io/api/skills/cmj-hub-cold-offer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/cmj-hub-cold-offer.md manifest signé GET /api/skills/cmj-hub-cold-offer/manifest lockfile signé GET /api/skills/cmj-hub-cold-offer/lockfile

Tester

Utilisation de « cold-offer ». Draft an offer about a homepage requesting meetings before showing any work.

Résultat attendu:

Finding: Your homepage asks for a meeting before showing a work sample.
Prototype: A one-page sample that presents the finding and a short trial first.
First email: Your homepage asks for a meeting before showing any work. I prepared a one-page alternative. May I share the full report?

Utilisation de « cold-offer ». Check a complete draft whose first email says: Buy our retainer.

Résultat attendu:

Result: Rejected because the first email contains a configured paid-product pitch phrase.
Revision: Share the specific finding and the prepared sample instead of asking for a purchase.

Utilisation de « cold-offer ». Check a draft with a finding and first email but no prototype.

Résultat attendu:

Result: Draft is incomplete.
Revision: Add a nonempty prototype description before checking again.

Audit de sécurité

Risque élevé

v1 • 03/10/2026 Ouvrir le rapport versionné

Most static findings are harmless documentation, CSS, encoding markers, or legitimate local tooling. Confirmed risks affect optional asset renderers: unsafe HTML insertion, inline script serialization, CSS interpolation, and unconditional frame directory deletion. No evidence found of prompt injection, credential theft, or malicious exfiltration; the Python scorer performs local validation without network access.

Fichiers analysés

701

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Élevé

assets/demo.mjs:13-14 assets/demo.mjs:67-68

Inline Script Breakout Through Specification Data

The demo renderer embeds JSON.stringify output directly in a script element. Supplied strings containing a closing script tag can terminate it and inject executable markup.

JSON.stringify does not escape HTML script terminators. The browser parses these serialized values inside an executable script element before DOM insertion.

Élevé

assets/card.mjs:17 assets/card.mjs:25-37 assets/demo.mjs:12 assets/demo.mjs:17-25

Unchecked Color Value Can Escape Style Elements

Both renderers interpolate supplied accent_color values directly into style elements. A crafted value can close the style element and introduce scripts or external resources.

Neither renderer validates accent_color before HTML interpolation. Text escaping elsewhere does not protect this separate style-element context.

Éléments d’évaluation des capacités (3)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into HTML without escaping. Malicious markup can execute browser event handlers during rendering.

Élevé

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines from the specification are inserted as unescaped HTML. Crafted tags can execute browser scripts or initiate unwanted requests.

Moyen

assets/demo.mjs:4

Synchronous file operations

import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

The imported rmSync recursively deletes the output-derived frames directory at lines 102 and 119. Existing contents are removed without an ownership check.

Facteurs de risque

🌐 Accès réseau (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:32

⚙️ Commandes externes (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:33 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48 SKILL.md:54-60 tests/test_score.py:14

📁 Accès au système de fichiers (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Variables d’environnement (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Contient des scripts (2)

assets/demo.mjs:90 assets/demo.mjs:91

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/cmj-hub-cold-offer/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-cold-offer/security.svg)](https://skillstore.io/skills/cmj-hub-cold-offer?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/cmj-hub-cold-offer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-cold-offer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/cmj-hub-cold-offer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

cmj-hub. (2026). cold-offer security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-cold-offer/audits/1

Citation BibTeX

@techreport{cmj-hub-cmj-hub-cold-offer-2026,
  author = {cmj-hub},
  title = {cold-offer security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-cold-offer/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cold-offer security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-cold-offer/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-cold-offer:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Founder Outreach

Draft a first email that shares a specific public-page observation and a small sample instead of requesting a demo.

Consulting Offer Preparation

Package a verified business finding with a limited solution sample before discussing a larger paid engagement.

Team Draft Review

Check draft completeness and configured pitch phrases before a human reviews the message for sending.

Essayez ces prompts

Draft a First Offer

Draft a cold offer from this verified observation: [finding]. Include a finding, a small solution sample, and a first email without a product pitch.

Rewrite a Pitch

Rewrite this email: [draft]. Lead with [verified finding], name [prepared sample], and remove purchase requests, meeting requests, and demo invitations.

Validate a Draft

Review my draft at [local path]. Use the local scorer to check required fields and pitch phrases, then suggest revisions without sending anything.

Prepare and Review Variants

Create three offer variants from [verified finding] and [prepared sample]. Compare clarity, validate each locally, and explain limitations of the phrase checks.

Bonnes pratiques

Use verified public observations and describe only samples you have actually prepared.
Review scorer results manually because fixed phrase checks can reject harmless text or miss sales pitches.
Keep the core drafting workflow separate from optional asset renderers until their security issues are fixed.

Éviter

Inventing recipient problems or claiming unfinished work is already available.
Treating a successful scorer result as proof of accuracy, compliance, or effective outreach.
Passing untrusted specifications to the optional renderers or reusing directories containing important files.