react-email

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the react-email and @react-email/editor packages from the official Node.js package registry.
  • [EXTERNAL_DOWNLOADS]: References official documentation and source code from the vendor's domains (resend.com, react.email) and GitHub repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied brand information (colors, logos) and email content to generate React-based HTML templates.
  • Ingestion points: Clarifying questions for brand configuration and template props defined in SKILL.md and references/PATTERNS.md.
  • Boundary markers: The behavioral guidelines in SKILL.md instruct the agent to avoid direct use of template variables in JSX to maintain template integrity.
  • Capability inventory: Includes shell command execution for project setup, file system writes for template creation, and network operations for sending emails through supported SDKs.
  • Sanitization: Relies on React's built-in XSS protection for component props while providing specific components like Text and Heading to structure output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:56 AM
Security Audit — agent-trust-hub — react-email