Kit Email Marketing Operator

The skill's stated purpose (write, schedule, send, and track ConvertKit broadcasts) matches the presence of kit-api.js and credentials handling. However registry metadata declares no required credentials/env vars or primary credential even though the runtime instructions require a Kit API key and secret to be collected and stored locally. That metadata mismatch is notable but not necessarily malicious.

SKILL.md directs the agent to collect Kit API credentials, voice-training samples, business context, and optionally ‘database integration’ paths; it then instructs the agent to read those local paths before generating emails. Allowing the skill to read arbitrary file paths (user-supplied) expands its scope beyond just 'email content' and could expose sensitive files if misused or if a user supplies paths carelessly. The docs also inconsistently reference multiple storage locations (e.g., /data/.openclaw/workspace/.kit-credentials vs ~/.kit-credentials vs /data/.openclaw/workspace/.kit-voice-profile.json), which could cause accidental reads/writes outside expected places.

There is no automated install spec in the registry (manual copy into the skills directory is implied). That lowers supply-chain risk because nothing is fetched at runtime, but the package includes executable scripts (credentials.js, kit-api.js) that will run locally. The install docs ask users to chmod and execute scripts; review those scripts before running. No external download URLs were used in the provided files.

Requesting a Kit API key and secret is proportionate to the stated functionality. However the package metadata lists no required env vars (contradicting the runtime need to collect API credentials). The skill also asks to store and later read user-provided local files (voice guides, memory files). Those file reads are functionally explainable for voice training, but they increase the potential for accidental exposure of unrelated sensitive data if paths are mis-specified or if the agent is given broad discretion to discover files.

The skill does not request 'always: true' and does not declare elevated platform privileges. It stores data locally in the workspace and claims to encrypt credentials; this is a normal persistence model for a local integration. However the encryption/storage claims are in documentation and not auditable from the manifest alone — see guidance.