Security Audit
brevo-automation
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
brevo-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Broad Brevo API access enables data exfiltration and content manipulation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Broad Brevo API access enables data exfiltration and content manipulation The skill provides access to a wide range of Brevo API operations, including listing, creating, updating, and deleting email campaigns and templates. This level of access, if misused by a compromised or misaligned LLM, could lead to:
1. **Data Exfiltration**: Listing campaigns (`BREVO_LIST_EMAIL_CAMPAIGNS`) and templates (`BREVO_GET_ALL_EMAIL_TEMPLATES`) can expose sensitive marketing content, customer data, and campaign strategies.
2. **Malicious Content Injection**: Updating campaigns (`BREVO_UPDATE_EMAIL_CAMPAIGN`) or creating/updating templates (`BREVO_CREATE_OR_UPDATE_EMAIL_TEMPLATE`) allows an LLM to inject arbitrary `htmlContent` and `subject` lines, potentially leading to phishing, spam, or brand reputation damage.
3. **Service Disruption**: Deleting templates (`BREVO_DELETE_EMAIL_TEMPLATE`) or misconfiguring campaigns could disrupt email marketing operations. Implement strict access controls and fine-grained permissions for the LLM's use of these tools. For example, restrict the LLM to only list campaigns/templates, or require human approval for any modifications or deletions. Ensure the LLM's prompts are carefully engineered to prevent misuse and that its outputs are validated before execution. Consider breaking down this skill into smaller, more specialized skills with narrower scopes of action. | LLM | SKILL.md:40 |
Scan History
Embed Code
[](https://skillshield.io/report/13bfbf50cb3c78a3)
Powered by SkillShield