react-email
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
react-emailand@react-email/editorpackages from the official Node.js package registry. - [EXTERNAL_DOWNLOADS]: References official documentation and source code from the vendor's domains (
resend.com,react.email) and GitHub repositories. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied brand information (colors, logos) and email content to generate React-based HTML templates.
- Ingestion points: Clarifying questions for brand configuration and template props defined in
SKILL.mdandreferences/PATTERNS.md. - Boundary markers: The behavioral guidelines in
SKILL.mdinstruct the agent to avoid direct use of template variables in JSX to maintain template integrity. - Capability inventory: Includes shell command execution for project setup, file system writes for template creation, and network operations for sending emails through supported SDKs.
- Sanitization: Relies on React's built-in XSS protection for component props while providing specific components like
TextandHeadingto structure output.
Audit Metadata