Skills extension-email-marketing

📦

extension-email-marketing

Name: extension-email-marketing
Author: caffeinelabs

v0.1.5 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Build Compliant Marketing Email Workflows

Marketing email systems need verified recipients, controlled sending, personalization, and reliable unsubscribe handling. This skill provides Motoko patterns and Caffeine AI modules for those workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "extension-email-marketing" from https://skillstore.io/skills/caffeinelabs-extension-email-marketing.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-email-marketing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/caffeinelabs-extension-email-marketing.md Signed manifest GET /api/skills/caffeinelabs-extension-email-marketing/manifest Signed lockfile GET /api/skills/caffeinelabs-extension-email-marketing/lockfile

Test it

Using "extension-email-marketing". Design a verified product newsletter with explicit opt-in.

Expected outcome:

A backend design separating registration, email verification, marketing consent, topic subscription, admin sending, and unsubscribe processing.

Using "extension-email-marketing". Add personalization to a campaign.

Expected outcome:

A recipient plan mapping each verified subscriber to a NAME substitution while preserving the required unsubscribe placeholder.

Using "extension-email-marketing". Review who can send and inspect campaigns.

Expected outcome:

An authorization review confirming admin checks for sending, topic changes, and subscriber listing, with public self-service subscription endpoints.

Security Audit

High Risk

v1 • 7/23/2026 Open versioned report

All 14 static alerts are false positives caused by Markdown syntax, documentation links, or ordinary Motoko code. One high-severity consent flaw remains: the example enrolls users in marketing without a separate, explicit opt-in.

Files scanned

332

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:207-219

Marketing Consent Bundled With Registration

The example subscribes every registrant before separate consent, then treats required email verification as agreement to marketing. This can create non-consensual subscriptions.

The code unconditionally adds each registrant to Newsletter, and the verification message explicitly bundles verification with newsletter agreement.

Risk Factors

⚙️ External commands (11)

SKILL.md:30 SKILL.md:34-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-96 SKILL.md:96-100 SKILL.md:100-103 SKILL.md:103-109 SKILL.md:109-129 SKILL.md:129-133 SKILL.md:133-331

🌐 Network access (1)

SKILL.md:14

📁 Filesystem access (1)

SKILL.md:26

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/caffeinelabs-extension-email-marketing/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-email-marketing/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-email-marketing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/caffeinelabs-extension-email-marketing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-email-marketing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-email-marketing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

caffeinelabs. (2026). extension-email-marketing security audit report (audit version 1) [Author version 0.1.5]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-email-marketing/audits/1

BibTeX citation

@techreport{caffeinelabs-caffeinelabs-extension-email-marketing-2026,
  author = {caffeinelabs},
  title = {extension-email-marketing security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-extension-email-marketing/audits/1},
  note = {Author version 0.1.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "extension-email-marketing security audit report (audit version 1)"
version: "0.1.5"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/caffeinelabs-extension-email-marketing/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-extension-email-marketing:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add a Product Newsletter

Implement a verified newsletter topic with personalized messages and per-recipient unsubscribe links.

Manage Marketing Topics

Create protected backend operations for topic administration, subscription changes, and subscriber status reviews.

Review Campaign Consent

Adapt the example to require explicit opt-in before adding verified users to marketing topics.

Try These Prompts

Explain the Modules

Explain how the subscribers, verification, authorization, email client, and unsubscribe modules work together in a Caffeine AI marketing workflow.

Create a Newsletter Backend

Create a Motoko backend for a newsletter named [TOPIC]. Require explicit opt-in, verified email, admin-only sending, personalization, and unsubscribe links.

Add Topic Administration

Extend my Motoko actor with admin-protected topic creation, renaming, removal, subscriber counts, and verified subscriber listing using the prefabricated modules.

Audit a Campaign Implementation

Review this Motoko marketing backend for consent, authorization, verified-recipient enforcement, HTML safety, unsubscribe behavior, error handling, and data exposure: [IMPLEMENTATION].

Best Practices

Collect explicit marketing consent separately from account registration and email verification.
Send campaigns only to subscribers who remain opted in and have verified email addresses.
Protect sending, topic management, and subscriber inspection with server-side admin authorization.

Avoid

Do not enroll every new account in marketing topics by default.
Do not store duplicate subscription state outside the prefabricated subscribers module.
Do not send marketing HTML without the unsubscribe placeholder.

Frequently Asked Questions

Which language and platform does this skill target?

It targets Motoko backends using Caffeine AI email, authorization, verification, and marketing packages.

Does the skill verify email addresses itself?

It integrates the Caffeine AI email verification modules and selects verified subscribers before campaign delivery.

Can campaigns personalize messages?

Yes. Each recipient can receive named substitution values that replace matching placeholders in the email body.

Are unsubscribe links supported?

Yes. The workflow uses an unsubscribe mixin and ensures the email body contains the required unsubscribe placeholder.

Does the example provide compliant consent handling?

No. Its default newsletter enrollment should be replaced with a separate, explicit marketing opt-in.

Does this skill include campaign analytics or scheduling?

No. It focuses on subscriber topics, verification, personalization, authorization, sending, and unsubscribe handling.

Developer Details

Author

caffeinelabs

License

MIT

Author version

v0.1.5

Skillstore revision

Repository

https://github.com/caffeinelabs/skills/tree/10fb452613c797633b8cb33639fc9a754a138039/skills/extension-email-marketing

Ref

f32f934280aa94e399d875d7cf7b2ed16d1b82a3

Maintenance freshness

7/23/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md