스킬 lifecycle-email

📦

lifecycle-email

Name: lifecycle-email
Author: cmj-hub

콘텐츠 리비전 r1 중간 위험 🌐 네트워크 접근⚙️ 외부 명령어📁 파일 시스템 접근🔑 환경 변수⚡ 스크립트 포함

Draft and Validate Opt-In Email Sequences

Generic follow-up emails can overlook the resource subscribers requested and the problem they described. This skill structures a three-part sequence and checks drafts locally.

지원: Claude Codex Code(CC)

⚠️ 50 나쁨

Maintain this Skill? Claim it ⚠️ 50 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "lifecycle-email" from https://skillstore.io/skills/cmj-hub-lifecycle-email.md and its manifest at https://skillstore.io/api/skills/cmj-hub-lifecycle-email/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/cmj-hub-lifecycle-email.md 서명된 manifest GET /api/skills/cmj-hub-lifecycle-email/manifest 서명된 lockfile GET /api/skills/cmj-hub-lifecycle-email/lockfile

테스트해 보기

"lifecycle-email" 사용 중입니다. An opted-in trial user requested a checklist. Their problem is: the trial dies after the first login.

예상 결과:

Welcome: You asked for the trial checklist. Thank you for signing up.
Bargain: Your requested trial checklist is available at [resource link].
Nurture: You said the trial dies after the first login. Which step prevents users from returning?

"lifecycle-email" 사용 중입니다. A draft contains a day 1 tip series and does not repeat the stated problem in nurture.

예상 결과:

Validation refused the draft. Replace the generic series with problem-specific follow-up and include the complete stated pain phrase.

"lifecycle-email" 사용 중입니다. A supplied draft contains incomplete JSON.

예상 결과:

Input validation failed with an invalid JSON error. The scorer does not print the malformed draft.

보안 감사

중간 위험

v1 • 2026. 10. 3. 버전별 보고서 열기

Most static findings are false positives involving template literals, CSS, documentation, byte-order-mark handling, and legitimate local commands. The optional asset renderers contain HTML injection risks, external font requests, and destructive cleanup of a predictable directory. No evidence found of credential theft, malicious exfiltration, or prompt injection.

스캔된 파일

711

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

중간

assets/card.mjs:16-17 assets/card.mjs:36-37 assets/demo.mjs:11-15 assets/demo.mjs:25-26 assets/demo.mjs:67-68

Untrusted specification can terminate renderer HTML blocks

Both renderers interpolate accent_color directly into style blocks. The demo embeds JSON.stringify(s) directly into a script block without escaping HTML delimiters. A crafted specification can terminate either block and introduce executable browser content before any innerHTML assignment.

The source directly inserts unvalidated strings into HTML style and script contexts. JSON serialization does not escape HTML closing tags; exploitation requires rendering an untrusted specification.

중간

assets/demo.mjs:100-102 assets/demo.mjs:119

Demo renderer deletes preexisting output-derived directories

The demo recursively deletes outGif plus the .frames suffix before creating its frame directory. It checks neither directory ownership nor prior contents. Selecting an output path can therefore erase an unrelated existing directory, and final cleanup repeats the recursive deletion.

rmSync uses recursive and force options on a predictable path derived from the caller's output argument. No exclusive temporary-directory creation or ownership check precedes deletion.

기능 검토 항목 (6)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into h without escaping. Assigning h to innerHTML allows attacker-controlled HTML and event handlers.

중간

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines enter innerHTML without escaping. Rendering an untrusted specification can execute injected browser code.

낮음

assets/card.mjs:22

Hardcoded URL

The generated page requests a preconnection to Google Fonts during rendering. This creates external network contact outside the offline scorer.

낮음

assets/card.mjs:23

Hardcoded URL

The generated page preconnects to Google's font asset host. Rendering can expose connection metadata to an external service.

낮음

assets/card.mjs:24

Hardcoded URL

The stylesheet link loads Google Fonts while Chrome renders local assets. It exposes request metadata and prevents fully offline rendering.

낮음

assets/demo.mjs:16

Hardcoded URL

The demo page loads a Google Fonts stylesheet in the browser. This exposes request metadata and introduces an external rendering dependency.

위험 요인

🌐 네트워크 접근 (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:35

⚙️ 외부 명령어 (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:31 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:52-59 tests/test_score.py:14

📁 파일 시스템 접근 (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 환경 변수 (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ 스크립트 포함 (2)

assets/demo.mjs:90 assets/demo.mjs:91

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg)](https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/cmj-hub-lifecycle-email.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

cmj-hub. (2026). lifecycle-email security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1

BibTeX 인용

@techreport{cmj-hub-cmj-hub-lifecycle-email-2026,
  author = {cmj-hub},
  title = {lifecycle-email security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lifecycle-email security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-lifecycle-email:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Follow up after a resource request

Draft a welcome, deliver the requested checklist, and write follow-up copy addressing the subscriber's stated problem.

Support trial onboarding

Create an opt-in trial sequence focused on a specific onboarding problem, then check that all three sections are present.

Review client email drafts

Check client-provided drafts for missing sections, blocked phrases, and absent problem references before manual editorial review.

이 프롬프트를 사용해 보세요

Draft a first sequence

Draft an opt-in sequence for subscribers who requested [resource]. Their stated problem is [pain]. Include welcome, bargain, and nurture sections.

Improve an existing draft

Review [draft] for subscribers who opted in for [resource]. Separate welcome, bargain, and nurture. Keep the full pain phrase [pain] in nurture.

Validate a local draft

Check [draft_path] with scripts/score.py. Explain any refusal or input error and propose corrections. Do not send emails or run asset renderers.

Compare audience-specific sequences

Draft sequences for [audiences] using their documented consent, promised resources, and exact pain phrases. Validate each and compare messaging. Flag unsupported claims for review.

모범 사례

Confirm subscriber consent and identify the exact resource promised before drafting.
Use the complete stated problem phrase in nurture, then review the copy for clarity and accuracy.
Run local validation on minimized drafts and manually review consent, links, claims, and delivery before sending.

피하기

Do not use this opt-in framework for unsolicited outreach.
Do not replace problem-specific nurture with a generic calendar of tips.
Do not treat a passing score as proof of consent, legal compliance, actual resource delivery, or campaign performance.

자주 묻는 질문

Does this skill send email?

No. It guides drafting and validates text. Sending and scheduling require your email platform.

What does bargain mean here?

Bargain is the section that delivers the resource or access promised when the subscriber opted in.

What does the scorer require?

It requires four nonempty text fields: pain, welcome, bargain, and nurture. Nurture must contain the full pain phrase, ignoring case.

Why can a reasonable draft fail?

Configured phrase matches can reject otherwise reasonable copy. A paraphrased pain phrase also fails because matching requires the complete phrase.

Does validation need network access or paid APIs?

The Python scorer uses only the standard library and makes no network requests. Optional asset rendering loads external fonts.

Are the optional renderers safe for untrusted specifications?

No. They contain HTML injection risks, and the demo deletes a predictable frame directory. Avoid untrusted specifications and unnecessary renderer execution.