sequenzy-email-marketing
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were identified. The skill acts as a legitimate interface for the Sequenzy platform, following security best practices for secret management and restricting operations to official vendor infrastructure.
- [DATA_EXFILTRATION]: The skill provides explicit safety instructions to prevent the exposure of API keys and signing secrets. It directs the agent to redact these values and store them in secure local environments. All network operations are directed towards official vendor endpoints (sequenzy.com, api.sequenzy.com).
- [COMMAND_EXECUTION]: The skill defines a constrained set of CLI and MCP tool operations. It emphasizes validation and user confirmation (via the
--yesrequirement) for all destructive actions such as deletions or cancellations. - [PROMPT_INJECTION]: The skill handles untrusted external data (CSV/HTML files, subscriber messages), which is a potential surface for indirect prompt injection.
- Ingestion points: Data enters via
subscribers import(CSV/JSON),campaigns create(HTML/blocks), andinbox reply(subscriber conversations). - Boundary markers: Explicit boundary markers for processed data are not defined in the instructions.
- Capability inventory: The skill can execute various CLI and MCP tools for data mutation and network operations.
- Sanitization: The skill mitigates risks by instructing the agent to 'Validate IDs, recipient email, subject, template, or content input' before issuing any mutation. No attempts to override agent safety protocols were found.
Audit Metadata