The Agent Skills Directory

[SAFE]: The skill strictly mandates server-side email sending, ensuring that sensitive credentials like the RESEND_API_KEY are never exposed to the client-side environment.
[SAFE]: It provides detailed implementation examples for verifying webhook signatures using the Resend SDK and the Svix library, which is essential for protecting the application against forged or replayed webhook events.
[SAFE]: The guidance includes patterns for CAN-SPAM compliance, such as implementing token-based unsubscribe links and checking user database preferences before sending non-transactional emails.
[INDIRECT_PROMPT_INJECTION]: The skill involves a surface where untrusted data (like user-provided names, notification titles, or message bodies) is interpolated into email templates. While this is a primary function of the skill, it creates a potential path for indirect prompt injection if an agent subsequently processes the content of these emails.
Ingestion points: Component props like userName, title, and body in the templates defined in examples/core.md and examples/templates.md.
Boundary markers: None identified; there are no specific instructions or delimiters used to wrap dynamic content to signal that embedded instructions should be ignored by an AI agent.
Capability inventory: Network operations for email delivery via resend.emails.send and resend.batch.send as shown in examples/core.md and examples/async-batch.md.
Sanitization: The examples rely on standard React rendering for XSS protection but do not include logical validation or escaping for natural language instructions embedded within text fields.

api-email-resend-react-email