Skills consent-registry

📦

consent-registry

Name: consent-registry
Author: aaron-he-zhu

v19.0.0 Content revision r2 Safe ⚙️ External commands🌐 Network access📁 Filesystem access

Manage consent records and suppressions

Consent evidence and withdrawal events can become inconsistent across marketing tools. This skill records pseudonymous consent facts and applies immediate suppression through a controlled registry.

Supports: Claude Codex Code(CC)

🥈 80 Silver

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "consent-registry" from https://skillstore.io/skills/aaron-he-zhu-consent-registry.md and its manifest at https://skillstore.io/api/skills/aaron-he-zhu-consent-registry/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/aaron-he-zhu-consent-registry.md Signed manifest GET /api/skills/aaron-he-zhu-consent-registry/manifest Signed lockfile GET /api/skills/aaron-he-zhu-consent-registry/lockfile

Test it

Using "consent-registry". Check the current status for subject sha256-7d9f.

Expected outcome:

Subject: sha256-7d9f
Suppression status: active
Next step: Do not send contact until a valid restore is recorded.

Using "consent-registry". Record a new opt-in with incomplete proof information.

Expected outcome:

Result: consent cannot be inferred
Missing evidence: lawful basis and proof reference
Next step: provide verified evidence before recording opt-in.

Security Audit

Safe

v7 • 7/26/2026 Open versioned report

Most detections are Markdown formatting, fixed documentation links, or fixed local path resolution. One documented shell invocation accepts a supplied subject ID without showing quoting or argument-array handling, which can create command-injection risk if copied into a shell. No prompt-injection or data-exfiltration intent was found.

Files scanned

Lines analyzed

Review items

False positives ignored

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:51-52

Ruby/shell backtick execution

2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is

The documented shell command inserts a supplied subject ID as an unquoted argument. An unsafe invocation could permit shell metacharacter injection unless the host uses argument arrays or validates the ID.

Risk Factors

⚙️ External commands (15)

SKILL.md:22-26 SKILL.md:26-30 SKILL.md:30 SKILL.md:32 SKILL.md:50 SKILL.md:51-52 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:56-57 SKILL.md:57 SKILL.md:63-65 SKILL.md:50 SKILL.md:50

🌐 Network access (2)

SKILL.md:10 SKILL.md:13

📁 Filesystem access (10)

SKILL.md:50 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:50

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/aaron-he-zhu-consent-registry/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/aaron-he-zhu-consent-registry/security.svg)](https://skillstore.io/skills/aaron-he-zhu-consent-registry?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/aaron-he-zhu-consent-registry?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aaron-he-zhu-consent-registry/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/aaron-he-zhu-consent-registry.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

aaron-he-zhu. (2026). consent-registry security audit report (audit version 7) [Author version 19.0.0]. Skillstore. https://skillstore.io/skills/aaron-he-zhu-consent-registry/audits/7

BibTeX citation

@techreport{aaron-he-zhu-aaron-he-zhu-consent-registry-2026,
  author = {aaron-he-zhu},
  title = {consent-registry security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/aaron-he-zhu-consent-registry/audits/7},
  note = {Author version 19.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "consent-registry security audit report (audit version 7)"
version: "19.0.0"
type: report
authors:
  - name: "aaron-he-zhu"
date-released: "2026-07-26"
url: "https://skillstore.io/skills/aaron-he-zhu-consent-registry/audits/7"
identifiers:
  - type: other
    value: "skillstore:aaron-he-zhu-consent-registry:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Record a verified opt-in

Add timestamped opt-in evidence with lawful basis and proof references.

Process an urgent unsubscribe

Immediately create a suppression record from a validated unsubscribe event.

Review consent before outreach

Check live suppression status and identify missing consent evidence.

Try These Prompts

Check suppression status

Check whether pseudonymous subject ID sha256-7d9f is currently suppressed.

Record an opt-in

Record opt-in for subject sha256-7d9f with source reference, timestamp, lawful basis, and proof reference.

Process an unsubscribe

Immediately suppress subject sha256-7d9f using unsubscribe event evt-882 and report the required confirmation steps.

Review a restore request

Review whether this restore request has fresh authorized opt-in evidence later than the previous withdrawal. List missing requirements.

Best Practices

Use a pseudonymous subject ID and never include raw contact information.
Provide source, timestamp, lawful basis, and proof references for every opt-in.
Recheck live suppression status before any downstream email action.

Avoid

Do not treat cached segments or exported rows as authoritative consent evidence.
Do not restore permission using older or proxy evidence.
Do not manually edit the consent stream or suppression cache.

Frequently Asked Questions

Does this skill send email?

No. It records consent facts and suppression status only.

Can it process an unsubscribe immediately?

Yes, when the producer is validated and required event details are available.

What identifier should I provide?

Provide a pseudonymous subject ID, not an email address or name.

Can missing proof be assumed valid?

No. Missing lawful basis or proof remains explicitly unknown.

Can a user be restored after withdrawal?

Only with fresh authorized opt-in evidence that is later than withdrawal.

Does erasure remove all records?

It removes projected payload while retaining a suppression tombstone.

Developer Details

Author

aaron-he-zhu

License

Apache-2.0

Author version

v19.0.0

Skillstore revision

Repository

https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/protocol/consent-registry

Ref

adcb3549b15782055d0beb6d29f113d20de08f92

Maintenance freshness

7/28/2026

Usage

2 downloads · 0 views

File structure

📄 SKILL.md