api-email-setup-resend
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions for configuring an email service provider and template engine.
- [CREDENTIALS_UNSAFE]: The skill includes explicit warnings and critical requirements to never hardcode API keys, mandating the use of the
RESEND_API_KEYenvironment variable instead. - [DATA_EXFILTRATION]: No suspicious network operations or sensitive data access patterns were detected. The domain verification steps involve standard DNS configuration (SPF, DKIM, DMARC) for a well-known service provider.
- [DYNAMIC_EXECUTION]: The use of the
renderutility from the official@react-email/renderpackage is a standard practice for converting React components to HTML and does not involve unsafe dynamic code generation from untrusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill templates for emails (e.g.,
VerificationEmail) ingest typical user data likeuserName. Since these are rendered via React components, they benefit from default output escaping, and no high-risk capabilities are exposed that would allow for agent context manipulation.
Audit Metadata