omnisend
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
@useclawlink/clipackage from the NPM registry. This is the official tool provided by the skill author (clawlink-hq) to facilitate the integration. - [COMMAND_EXECUTION]: Utilizes shell commands via
npxto interact with the Omnisend API. The skill uses these commands to list, describe, and run marketing automation actions. - [CREDENTIALS_UNSAFE]: Mentions that authentication credentials are stored locally in the user's home directory (
~/.clawlink/credentials.json). This is a standard and safe practice for CLI tools to manage session tokens obtained via OAuth/browser login. - [PROMPT_INJECTION]: Ingests data from external Omnisend resources (contacts, products, campaigns) which represents an indirect prompt injection surface. The skill instructions mitigate this risk by explicitly requiring the agent to confirm with the user before performing any write operations.
Audit Metadata