📦

cold-offer

Name: cold-offer
Author: cmj-hub

Revisão do conteúdo r1 Risco alto 🌐 Acesso à rede⚙️ Comandos externos📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente⚡ Contém scripts

Draft Cold Offers Around Concrete Findings

Cold outreach often asks for a purchase before showing useful work. This skill structures a finding, a small solution sample, and a first email with local draft checks.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "cold-offer" from https://skillstore.io/skills/cmj-hub-cold-offer.md and its manifest at https://skillstore.io/api/skills/cmj-hub-cold-offer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/cmj-hub-cold-offer.md manifest assinado GET /api/skills/cmj-hub-cold-offer/manifest lockfile assinado GET /api/skills/cmj-hub-cold-offer/lockfile

Testar

Usando "cold-offer". Draft an offer about a homepage requesting meetings before showing any work.

Resultado esperado:

Finding: Your homepage asks for a meeting before showing a work sample.
Prototype: A one-page sample that presents the finding and a short trial first.
First email: Your homepage asks for a meeting before showing any work. I prepared a one-page alternative. May I share the full report?

Usando "cold-offer". Check a complete draft whose first email says: Buy our retainer.

Resultado esperado:

Result: Rejected because the first email contains a configured paid-product pitch phrase.
Revision: Share the specific finding and the prepared sample instead of asking for a purchase.

Usando "cold-offer". Check a draft with a finding and first email but no prototype.

Resultado esperado:

Result: Draft is incomplete.
Revision: Add a nonempty prototype description before checking again.

Auditoria de segurança

Risco alto

v1 • 03/10/2026 Abrir o relatório versionado

Most static findings are harmless documentation, CSS, encoding markers, or legitimate local tooling. Confirmed risks affect optional asset renderers: unsafe HTML insertion, inline script serialization, CSS interpolation, and unconditional frame directory deletion. No evidence found of prompt injection, credential theft, or malicious exfiltration; the Python scorer performs local validation without network access.

Arquivos analisados

701

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

assets/demo.mjs:13-14 assets/demo.mjs:67-68

Inline Script Breakout Through Specification Data

The demo renderer embeds JSON.stringify output directly in a script element. Supplied strings containing a closing script tag can terminate it and inject executable markup.

JSON.stringify does not escape HTML script terminators. The browser parses these serialized values inside an executable script element before DOM insertion.

Alto

assets/card.mjs:17 assets/card.mjs:25-37 assets/demo.mjs:12 assets/demo.mjs:17-25

Unchecked Color Value Can Escape Style Elements

Both renderers interpolate supplied accent_color values directly into style elements. A crafted value can close the style element and introduce scripts or external resources.

Neither renderer validates accent_color before HTML interpolation. Text escaping elsewhere does not protect this separate style-element context.

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into HTML without escaping. Malicious markup can execute browser event handlers during rendering.

Alto

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines from the specification are inserted as unescaped HTML. Crafted tags can execute browser scripts or initiate unwanted requests.

Médio

assets/demo.mjs:4

Synchronous file operations

import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

The imported rmSync recursively deletes the output-derived frames directory at lines 102 and 119. Existing contents are removed without an ownership check.

Fatores de risco

🌐 Acesso à rede (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:32

⚙️ Comandos externos (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:33 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48 SKILL.md:54-60 tests/test_score.py:14

📁 Acesso ao sistema de arquivos (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Variáveis de ambiente (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Contém scripts (2)

assets/demo.mjs:90 assets/demo.mjs:91

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/cmj-hub-cold-offer/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-cold-offer/security.svg)](https://skillstore.io/skills/cmj-hub-cold-offer?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/cmj-hub-cold-offer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-cold-offer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/cmj-hub-cold-offer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

cmj-hub. (2026). cold-offer security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-cold-offer/audits/1

Citação BibTeX

@techreport{cmj-hub-cmj-hub-cold-offer-2026,
  author = {cmj-hub},
  title = {cold-offer security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-cold-offer/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cold-offer security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-cold-offer/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-cold-offer:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Founder Outreach

Draft a first email that shares a specific public-page observation and a small sample instead of requesting a demo.

Consulting Offer Preparation

Package a verified business finding with a limited solution sample before discussing a larger paid engagement.

Team Draft Review

Check draft completeness and configured pitch phrases before a human reviews the message for sending.

Teste estes prompts

Draft a First Offer

Draft a cold offer from this verified observation: [finding]. Include a finding, a small solution sample, and a first email without a product pitch.

Rewrite a Pitch

Rewrite this email: [draft]. Lead with [verified finding], name [prepared sample], and remove purchase requests, meeting requests, and demo invitations.

Validate a Draft

Review my draft at [local path]. Use the local scorer to check required fields and pitch phrases, then suggest revisions without sending anything.

Prepare and Review Variants

Create three offer variants from [verified finding] and [prepared sample]. Compare clarity, validate each locally, and explain limitations of the phrase checks.

Boas práticas

Use verified public observations and describe only samples you have actually prepared.
Review scorer results manually because fixed phrase checks can reject harmless text or miss sales pitches.
Keep the core drafting workflow separate from optional asset renderers until their security issues are fixed.

Evitar

Inventing recipient problems or claiming unfinished work is already available.
Treating a successful scorer result as proof of accuracy, compliance, or effective outreach.
Passing untrusted specifications to the optional renderers or reusing directories containing important files.