Email Marketing

Email marketing automation for campaigns, newsletters, and customer engagement. Use when creating email sequences, drip campaigns, promotional emails, or cus...

This package looks like a simple local email campaign tool, but there are clear mismatches you should consider before installing: - Missing files: SKILL.md references many helper scripts (customer sync, abandoned-cart, analytics) that are not present. Expect incomplete functionality. - Sending will likely fail: the CLI call to send does not provide SMTP config; the code expects an smtp_config object. You will need to supply or modify code to provide SMTP credentials or integrate with an email API. - Secrets handling: because the skill does not declare any required credentials, you may be tempted to hard-code SMTP or API keys into files or environment variables — avoid doing this without reviewing the code and understanding where credentials are stored/transmitted. - Data storage: the script stores lists and campaigns under local folders (lists/, campaigns/) and writes CSV/JSON files there. If you run it, ensure you run in an isolated directory and verify file contents. - Compliance: templates include unsubscribe placeholders and mailing-address guidance; you still must ensure legal compliance yourself and confirm unsubscribe handling is implemented (the code does not send or process unsubscribe webhooks). Recommendations: inspect and test the email_campaign.py in a safe environment (use --dry-run), do not supply SMTP/API credentials until you confirm how they are used/stored, and ask the publisher for the missing integration scripts or an updated release that documents credential requirements. If you need full Taobao/Douyin integration or hosted sending, prefer a skill that explicitly declares the required credentials and provides the integration code.

Type: OpenClaw Skill Name: yinan-email-marketing Version: 1.0.1 The skill bundle contains a path traversal vulnerability in `scripts/email_campaign.py`, where user-provided arguments for campaign names, subscriber lists, and templates are used to construct file paths without sanitization. While the code appears to follow its stated purpose of email marketing, it is incomplete: the core SMTP sending logic is commented out as a placeholder, and several scripts described in `SKILL.md` (e.g., `sync_customers.py`, `abandoned_cart.py`) are missing from the bundle. These vulnerabilities and inconsistencies represent a security risk if the agent is targeted by prompt injection, although no clear evidence of malicious intent was found.