api-email-setup-resend

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides legitimate instructions for configuring an email service provider and template engine.
  • [CREDENTIALS_UNSAFE]: The skill includes explicit warnings and critical requirements to never hardcode API keys, mandating the use of the RESEND_API_KEY environment variable instead.
  • [DATA_EXFILTRATION]: No suspicious network operations or sensitive data access patterns were detected. The domain verification steps involve standard DNS configuration (SPF, DKIM, DMARC) for a well-known service provider.
  • [DYNAMIC_EXECUTION]: The use of the render utility from the official @react-email/render package is a standard practice for converting React components to HTML and does not involve unsafe dynamic code generation from untrusted sources.
  • [INDIRECT_PROMPT_INJECTION]: The skill templates for emails (e.g., VerificationEmail) ingest typical user data like userName. Since these are rendered via React components, they benefit from default output escaping, and no high-risk capabilities are exposed that would allow for agent context manipulation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 03:56 PM
Security Audit — agent-trust-hub — api-email-setup-resend