claude-email-marketing-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a knowledge base and instruction set for email marketing tasks.
- [COMMAND_EXECUTION]: Provides standard diagnostic commands (e.g.,
digfor DNS checking) and installation instructions (git clone). These are benign, user-initiated actions for legitimate technical tasks. - [CREDENTIALS_SAFE]: Properly demonstrates the use of environment variables (e.g.,
process.env.KLAVIYO_PUBLIC_API_KEY,$SENDGRID_API_KEY,os.environ.get("ANTHROPIC_API_KEY")) for sensitive tokens rather than hardcoding credentials. - [EXTERNAL_DOWNLOADS]: Contains a link to a GitHub repository for installation and an external website (ara.so). Both are documented neutrally as sources for the skill's content and do not involve automated execution of untrusted remote code.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user queries about email marketing (ingestion point), it does not execute these as instructions or perform high-privilege actions based on the input. The risk is negligible as it functions as an advisory tool.
Audit Metadata