react-email-templates
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (MEDIUM): The script
scripts/setup-preview-server.shautomatically installs npm packages (react-email,@react-email/components) and suggests installing others (express,ts-node). These packages are not from the explicitly trusted list of organizations provided in the security guidelines. - COMMAND_EXECUTION (LOW): The skill utilizes shell scripts (
setup-preview-server.sh,validate-component.sh) to perform environment setup, package management, and file validation. These scripts are intended for local development use. - DYNAMIC_EXECUTION (LOW): The skill dynamically generates two TypeScript files (
scripts/preview.tsandscripts/dev-server.ts) which are subsequently executed viats-nodefor the development workflow. - DATA_EXPOSURE (LOW): The generated
dev-server.tscontains a path traversal vulnerability in the/preview/:nameroute. The code usespath.join('.email-previews',${req.params.name}.html)without sanitizing thenameparameter, allowing an attacker to potentially read any.htmlfile on the filesystem by using directory traversal sequences like../../.
Audit Metadata