Habilidades lifecycle-email

📦

lifecycle-email

Name: lifecycle-email
Author: cmj-hub

Revisão do conteúdo r1 Risco Médio 🌐 Acesso à rede⚙️ Comandos externos📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente⚡ Contém scripts

Draft and Validate Opt-In Email Sequences

Generic follow-up emails can overlook the resource subscribers requested and the problem they described. This skill structures a three-part sequence and checks drafts locally.

Suporta: Claude Codex Code(CC)

⚠️ 50 Ruim

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "lifecycle-email" from https://skillstore.io/skills/cmj-hub-lifecycle-email.md and its manifest at https://skillstore.io/api/skills/cmj-hub-lifecycle-email/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/cmj-hub-lifecycle-email.md manifest assinado GET /api/skills/cmj-hub-lifecycle-email/manifest lockfile assinado GET /api/skills/cmj-hub-lifecycle-email/lockfile

Testar

Usando "lifecycle-email". An opted-in trial user requested a checklist. Their problem is: the trial dies after the first login.

Resultado esperado:

Welcome: You asked for the trial checklist. Thank you for signing up.
Bargain: Your requested trial checklist is available at [resource link].
Nurture: You said the trial dies after the first login. Which step prevents users from returning?

Usando "lifecycle-email". A draft contains a day 1 tip series and does not repeat the stated problem in nurture.

Resultado esperado:

Validation refused the draft. Replace the generic series with problem-specific follow-up and include the complete stated pain phrase.

Usando "lifecycle-email". A supplied draft contains incomplete JSON.

Resultado esperado:

Input validation failed with an invalid JSON error. The scorer does not print the malformed draft.

Auditoria de segurança

Risco Médio

v1 • 03/10/2026 Abrir o relatório versionado

Most static findings are false positives involving template literals, CSS, documentation, byte-order-mark handling, and legitimate local commands. The optional asset renderers contain HTML injection risks, external font requests, and destructive cleanup of a predictable directory. No evidence found of credential theft, malicious exfiltration, or prompt injection.

Arquivos analisados

711

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Médio

assets/card.mjs:16-17 assets/card.mjs:36-37 assets/demo.mjs:11-15 assets/demo.mjs:25-26 assets/demo.mjs:67-68

Untrusted specification can terminate renderer HTML blocks

Both renderers interpolate accent_color directly into style blocks. The demo embeds JSON.stringify(s) directly into a script block without escaping HTML delimiters. A crafted specification can terminate either block and introduce executable browser content before any innerHTML assignment.

The source directly inserts unvalidated strings into HTML style and script contexts. JSON serialization does not escape HTML closing tags; exploitation requires rendering an untrusted specification.

Médio

assets/demo.mjs:100-102 assets/demo.mjs:119

Demo renderer deletes preexisting output-derived directories

The demo recursively deletes outGif plus the .frames suffix before creating its frame directory. It checks neither directory ownership nor prior contents. Selecting an output path can therefore erase an unrelated existing directory, and final cleanup repeats the recursive deletion.

rmSync uses recursive and force options on a predictable path derived from the caller's output argument. No exclusive temporary-directory creation or ownership check precedes deletion.

Itens de revisão de capacidade (6)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into h without escaping. Assigning h to innerHTML allows attacker-controlled HTML and event handlers.

Médio

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines enter innerHTML without escaping. Rendering an untrusted specification can execute injected browser code.

Baixo

assets/card.mjs:22

Hardcoded URL

The generated page requests a preconnection to Google Fonts during rendering. This creates external network contact outside the offline scorer.

Baixo

assets/card.mjs:23

Hardcoded URL

The generated page preconnects to Google's font asset host. Rendering can expose connection metadata to an external service.

Baixo

assets/card.mjs:24

Hardcoded URL

The stylesheet link loads Google Fonts while Chrome renders local assets. It exposes request metadata and prevents fully offline rendering.

Baixo

assets/demo.mjs:16

Hardcoded URL

The demo page loads a Google Fonts stylesheet in the browser. This exposes request metadata and introduces an external rendering dependency.

Fatores de risco

🌐 Acesso à rede (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:35

⚙️ Comandos externos (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:31 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:52-59 tests/test_score.py:14

📁 Acesso ao sistema de arquivos (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Variáveis de ambiente (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Contém scripts (2)

assets/demo.mjs:90 assets/demo.mjs:91

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg)](https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/cmj-hub-lifecycle-email?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-lifecycle-email/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/cmj-hub-lifecycle-email.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

cmj-hub. (2026). lifecycle-email security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1

Citação BibTeX

@techreport{cmj-hub-cmj-hub-lifecycle-email-2026,
  author = {cmj-hub},
  title = {lifecycle-email security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lifecycle-email security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-lifecycle-email/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-lifecycle-email:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Follow up after a resource request

Draft a welcome, deliver the requested checklist, and write follow-up copy addressing the subscriber's stated problem.

Support trial onboarding

Create an opt-in trial sequence focused on a specific onboarding problem, then check that all three sections are present.

Review client email drafts

Check client-provided drafts for missing sections, blocked phrases, and absent problem references before manual editorial review.

Teste estes prompts

Draft a first sequence

Draft an opt-in sequence for subscribers who requested [resource]. Their stated problem is [pain]. Include welcome, bargain, and nurture sections.

Improve an existing draft

Review [draft] for subscribers who opted in for [resource]. Separate welcome, bargain, and nurture. Keep the full pain phrase [pain] in nurture.

Validate a local draft

Check [draft_path] with scripts/score.py. Explain any refusal or input error and propose corrections. Do not send emails or run asset renderers.

Compare audience-specific sequences

Draft sequences for [audiences] using their documented consent, promised resources, and exact pain phrases. Validate each and compare messaging. Flag unsupported claims for review.

Boas práticas

Confirm subscriber consent and identify the exact resource promised before drafting.
Use the complete stated problem phrase in nurture, then review the copy for clarity and accuracy.
Run local validation on minimized drafts and manually review consent, links, claims, and delivery before sending.

Evitar

Do not use this opt-in framework for unsolicited outreach.
Do not replace problem-specific nurture with a generic calendar of tips.
Do not treat a passing score as proof of consent, legal compliance, actual resource delivery, or campaign performance.

Perguntas frequentes

Does this skill send email?

No. It guides drafting and validates text. Sending and scheduling require your email platform.

What does bargain mean here?

Bargain is the section that delivers the resource or access promised when the subscriber opted in.

What does the scorer require?

It requires four nonempty text fields: pain, welcome, bargain, and nurture. Nurture must contain the full pain phrase, ignoring case.

Why can a reasonable draft fail?

Configured phrase matches can reject otherwise reasonable copy. A paraphrased pain phrase also fails because matching requires the complete phrase.

Does validation need network access or paid APIs?

The Python scorer uses only the standard library and makes no network requests. Optional asset rendering loads external fonts.

Are the optional renderers safe for untrusted specifications?

No. They contain HTML injection risks, and the demo deletes a predictable frame directory. Avoid untrusted specifications and unnecessary renderer execution.