sales-kickofflabs
Provides guidance on using KickoffLabs for viral marketing campaigns, including waitlists, giveaways, and referral programs.
Install this skill
Security score
The sales-kickofflabs skill was audited on Jun 8, 2026 and we found 15 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 3 | description: "KickoffLabs platform help — viral marketing for pre-launch waitlists, bonus-entry giveaways, milestone-reward referral programs, and leaderboard giveaways with REST API v1 + v2, server-s |
Webhook reference - potential data exfiltration
| 22 | - F) Connect API or webhooks — v1 `/subscribe` vs v2 `/v2/{CAMPAIGN_ID}/...` |
Webhook reference - potential data exfiltration
| 24 | - H) Interpret webhook `__fraudulent` reasons (duplicate_ip / bounced / duplidate_email) |
Webhook reference - potential data exfiltration
| 30 | 3. **What's your ESP and website stack?** Drives whether native ESP integration is enough or you need API/webhooks/Zapier glue. |
Webhook reference - potential data exfiltration
| 52 | **Read `references/kickofflabs-api-reference.md`** for the REST API documentation — v1 (`/subscribe`, `/info`) + v2 (`/v2/{CAMPAIGN_ID}/...` for tags, leads, actions, leaderboard, approve, block, wait |
Webhook reference - potential data exfiltration
| 66 | - **Fraud-detection flags in webhook**: `duplicate_ip` (same IP signing up multiple times), `bounced` (email bounced on verify), `duplidate_email` (their typo — duplicate email). Treat them as advisor |
Webhook reference - potential data exfiltration
| 76 | 2. **`duplidate_email` is spelled with a typo in KickoffLabs's own webhook payload docs.** When parsing the `__fraudulent` array, match against the literal string `duplidate_email` as well as `duplica |
Webhook reference - potential data exfiltration
| 85 | 11. **Webhook signing is undocumented in public material.** No HMAC/signature scheme published. Verify caller IP or use a shared-secret query param if signing matters; or contact support to confirm cu |
Webhook reference - potential data exfiltration
| 95 | - `/sales-referralhero` — ReferralHero (full-stack referral/affiliate/waitlist/contest with multi-level Level 1/2/3 + coupon groups + REST API + webhooks + Zapier) |
Webhook reference - potential data exfiltration
| 110 | ### Example 2: Webhook payload `__fraudulent` interpretation |
Webhook reference - potential data exfiltration
| 111 | **User says**: "I'm getting webhooks with `__fraudulent` arrays containing `duplidate_email` and `bounced` — what do these mean and what should I do?" |
Webhook reference - potential data exfiltration
| 113 | **Result**: User builds a webhook handler that routes by fraud reason and queues borderline cases for human review with batch approve. |
Webhook reference - potential data exfiltration
| 127 | ### Webhooks fire but the `__fraudulent` field is empty when I expected fraud |
Webhook reference - potential data exfiltration
| 128 | **Symptom**: A lead clearly looks fraudulent (same IP repeating, disposable email) but the webhook arrives without a `__fraudulent` array |
External URL reference
| 117 | **Skill does**: Provides `POST https://api.kickofflabs.com/v1/{CAMPAIGN_ID}/subscribe` with `email`, `api_key`, `social_id` (the referrer's social_id, found in `?kid=` query param), `ip`, `__url`, and |