email-system-builder
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/setup_email.pyusesos.systemto install dependencies. The commands are mapped to specific, hardcoded package names (resend,@sendgrid/mail) based on an equality check of the provider input, which prevents arbitrary command injection. - [EXTERNAL_DOWNLOADS]: The skill installs official libraries from the npm registry for well-known email providers. These downloads are part of the intended functionality and target established services.
- [SAFE]: The skill demonstrates good security practices by instructing the user to store secrets in a
.env.localfile. The keys provided in the source code (re_...,SG..., etc.) are illustrative placeholders and not functional credentials.
Audit Metadata