sales-transactional-email
Facilitates transactional email delivery, covering provider selection, template design, and API integration for various platforms.
Install this skill
Security score
The sales-transactional-email skill was audited on Jun 14, 2026 and we found 11 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 81 | | **Webhooks** | Yes (Event Webhook) | Yes (7 types) | Yes (8 events) | Yes | Yes | SNS notifications | |
Webhook reference - potential data exfiltration
| 111 | - **API**: `POST /api/subscribers` for contact management, webhooks for delivery tracking. See `/sales-mailerlite` for full API reference. |
Webhook reference - potential data exfiltration
| 124 | 4. **Webhooks can fail silently** — if your webhook endpoint is down, you'll miss delivery/bounce events. Implement webhook logging and alerting. |
Webhook reference - potential data exfiltration
| 167 | **Skill does**: Identifies SMTP queuing as likely cause. Recommends switching to REST API for time-sensitive emails. Shows Mailgun API example for password reset. Suggests monitoring with webhooks. |
Webhook reference - potential data exfiltration
| 172 | **Skill does**: Walks through creating a template in Brevo UI → calling POST /smtp/email with templateId and params → setting up delivery webhooks → error handling and retry logic |
Webhook reference - potential data exfiltration
| 187 | ### Webhook events not arriving |
Webhook reference - potential data exfiltration
| 188 | **Symptom**: No webhook callbacks received after sending emails |
Webhook reference - potential data exfiltration
| 189 | **Cause**: Webhook endpoint misconfigured, firewall blocking provider IPs, or SSL certificate issues |
Webhook reference - potential data exfiltration
| 190 | **Solution**: 1) Verify webhook URL is publicly accessible (not localhost). 2) Check that your endpoint returns 200 within 5 seconds. 3) Whitelist provider IP ranges if behind a firewall. 4) Check pro |
Access to hidden dotfiles in home directory
| 134 | - If `~/.claude/skills/{skill-name}/SKILL.md` exists locally, `Read` it. |
Access to hidden dotfiles in home directory
| 136 | - For non-`sales-*` skills (third-party), look up `{org}/{repo}` in `~/.claude/skills/sales-do/references/skill-sources.md` if installed and fetch the same `skills/{skill-name}/SKILL.md` path under th |