📦

lifecycle-email

Name: lifecycle-email
Author: cmj-hub

Révision du contenu r1 Risque moyen 🌐 Accès réseau⚙️ Commandes externes📁 Accès au système de fichiers🔑 Variables d’environnement⚡ Contient des scripts

Draft and Validate Opt-In Email Sequences

Generic follow-up emails can overlook the resource subscribers requested and the problem they described. This skill structures a three-part sequence and checks drafts locally.

Prend en charge: Claude Codex Code(CC)

⚠️ 50 Médiocre

Maintain this Skill? Claim it ⚠️ 50 Médiocre

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "lifecycle-email" from https://skillstore.io/skills/cmj-hub-lifecycle-email.md and its manifest at https://skillstore.io/api/skills/cmj-hub-lifecycle-email/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/cmj-hub-lifecycle-email.md manifest signé GET /api/skills/cmj-hub-lifecycle-email/manifest lockfile signé GET /api/skills/cmj-hub-lifecycle-email/lockfile

Tester

Utilisation de « lifecycle-email ». An opted-in trial user requested a checklist. Their problem is: the trial dies after the first login.

Résultat attendu:

Welcome: You asked for the trial checklist. Thank you for signing up.
Bargain: Your requested trial checklist is available at [resource link].
Nurture: You said the trial dies after the first login. Which step prevents users from returning?

Utilisation de « lifecycle-email ». A draft contains a day 1 tip series and does not repeat the stated problem in nurture.

Résultat attendu:

Validation refused the draft. Replace the generic series with problem-specific follow-up and include the complete stated pain phrase.

Utilisation de « lifecycle-email ». A supplied draft contains incomplete JSON.

Résultat attendu:

Input validation failed with an invalid JSON error. The scorer does not print the malformed draft.

Audit de sécurité

Risque moyen

v1 • 03/10/2026 Ouvrir le rapport versionné

Most static findings are false positives involving template literals, CSS, documentation, byte-order-mark handling, and legitimate local commands. The optional asset renderers contain HTML injection risks, external font requests, and destructive cleanup of a predictable directory. No evidence found of credential theft, malicious exfiltration, or prompt injection.

Fichiers analysés

711

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Moyen

assets/card.mjs:16-17 assets/card.mjs:36-37 assets/demo.mjs:11-15 assets/demo.mjs:25-26 assets/demo.mjs:67-68

Untrusted specification can terminate renderer HTML blocks

Both renderers interpolate accent_color directly into style blocks. The demo embeds JSON.stringify(s) directly into a script block without escaping HTML delimiters. A crafted specification can terminate either block and introduce executable browser content before any innerHTML assignment.

The source directly inserts unvalidated strings into HTML style and script contexts. JSON serialization does not escape HTML closing tags; exploitation requires rendering an untrusted specification.

Moyen

assets/demo.mjs:100-102 assets/demo.mjs:119

Demo renderer deletes preexisting output-derived directories

The demo recursively deletes outGif plus the .frames suffix before creating its frame directory. It checks neither directory ownership nor prior contents. Selecting an output path can therefore erase an unrelated existing directory, and final cleanup repeats the recursive deletion.

rmSync uses recursive and force options on a predictable path derived from the caller's output argument. No exclusive temporary-directory creation or ownership check precedes deletion.

Éléments d’évaluation des capacités (6)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into h without escaping. Assigning h to innerHTML allows attacker-controlled HTML and event handlers.

Moyen

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines enter innerHTML without escaping. Rendering an untrusted specification can execute injected browser code.

Faible

assets/card.mjs:22

Hardcoded URL

The generated page requests a preconnection to Google Fonts during rendering. This creates external network contact outside the offline scorer.

Faible

assets/card.mjs:23

Hardcoded URL

The generated page preconnects to Google's font asset host. Rendering can expose connection metadata to an external service.

Faible

assets/card.mjs:24

Hardcoded URL

The stylesheet link loads Google Fonts while Chrome renders local assets. It exposes request metadata and prevents fully offline rendering.

Faible

assets/demo.mjs:16

Hardcoded URL

The demo page loads a Google Fonts stylesheet in the browser. This exposes request metadata and introduces an external rendering dependency.

Facteurs de risque

🌐 Accès réseau (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:35

⚙️ Commandes externes (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:31 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:52-59 tests/test_score.py:14

📁 Accès au système de fichiers (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Variables d’environnement (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Contient des scripts (2)

assets/demo.mjs:90 assets/demo.mjs:91

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg)](https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/cmj-hub-lifecycle-email.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

cmj-hub. (2026). lifecycle-email security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1

Citation BibTeX

@techreport{cmj-hub-cmj-hub-lifecycle-email-2026,
  author = {cmj-hub},
  title = {lifecycle-email security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lifecycle-email security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-lifecycle-email:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Follow up after a resource request

Draft a welcome, deliver the requested checklist, and write follow-up copy addressing the subscriber's stated problem.

Support trial onboarding

Create an opt-in trial sequence focused on a specific onboarding problem, then check that all three sections are present.

Review client email drafts

Check client-provided drafts for missing sections, blocked phrases, and absent problem references before manual editorial review.

Essayez ces prompts

Draft a first sequence

Draft an opt-in sequence for subscribers who requested [resource]. Their stated problem is [pain]. Include welcome, bargain, and nurture sections.

Improve an existing draft

Review [draft] for subscribers who opted in for [resource]. Separate welcome, bargain, and nurture. Keep the full pain phrase [pain] in nurture.

Validate a local draft

Check [draft_path] with scripts/score.py. Explain any refusal or input error and propose corrections. Do not send emails or run asset renderers.

Compare audience-specific sequences

Draft sequences for [audiences] using their documented consent, promised resources, and exact pain phrases. Validate each and compare messaging. Flag unsupported claims for review.

Bonnes pratiques

Confirm subscriber consent and identify the exact resource promised before drafting.
Use the complete stated problem phrase in nurture, then review the copy for clarity and accuracy.
Run local validation on minimized drafts and manually review consent, links, claims, and delivery before sending.

Éviter

Do not use this opt-in framework for unsolicited outreach.
Do not replace problem-specific nurture with a generic calendar of tips.
Do not treat a passing score as proof of consent, legal compliance, actual resource delivery, or campaign performance.

Foire aux questions

Does this skill send email?

No. It guides drafting and validates text. Sending and scheduling require your email platform.

What does bargain mean here?

Bargain is the section that delivers the resource or access promised when the subscriber opted in.

What does the scorer require?

It requires four nonempty text fields: pain, welcome, bargain, and nurture. Nurture must contain the full pain phrase, ignoring case.

Why can a reasonable draft fail?

Configured phrase matches can reject otherwise reasonable copy. A paraphrased pain phrase also fails because matching requires the complete phrase.

Does validation need network access or paid APIs?

The Python scorer uses only the standard library and makes no network requests. Optional asset rendering loads external fonts.

Are the optional renderers safe for untrusted specifications?

No. They contain HTML injection risks, and the demo deletes a predictable frame directory. Avoid untrusted specifications and unnecessary renderer execution.