instantly-email

This module appears to be a straightforward lead-upload automation tool: it reads pending leads from PostgreSQL, posts lead data to a hardcoded Instantly API endpoint with a bearer token from environment variables, and updates DB status on success. There is no clear evidence of intentional malware, backdoor, or covert remote control in this file. The primary security concerns are (1) disabling PostgreSQL TLS certificate verification (ssl.rejectUnauthorized:false), which increases MITM exposure for data and credentials in transit, and (2) the empty CAMPAIGN_MAP causing silent skipping of leads (configuration/logic issue). Secondary operational hygiene concerns include lack of a guard for missing INSTANTLY_API_KEY and inherent privacy risk from sending PII to a third party (though the endpoint is hardcoded).

SUSPICIOUS. The core Instantly integration is plausible and mostly aligned with the stated purpose, but the skill has medium risk because it automates real-world email sending, uses a second non-Instantly credential boundary, and includes destructive DB reset behavior. No clear malware or deceptive installer is shown, but the missing script code leaves data routing and credential handling insufficiently verifiable.