nodemailer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill provides legitimate documentation for the 'nodemailer' Node.js module.
- [SAFE]: The skill correctly demonstrates best practices for credential management by referencing environment variables (e.g.,
process.env.EMAIL_PASS,process.env.GOOGLE_CLIENT_SECRET) rather than hardcoding sensitive information. - [INDIRECT_PROMPT_INJECTION]: The skill examples demonstrate interpolating data into HTML templates (e.g.,
${user.name}). While this is the intended primary purpose of the tool, it represents a surface for indirect prompt injection if the source of theuserobject is untrusted. This is a standard risk for templating engines and is documented here for completeness; it does not escalate the verdict given the context of the skill.
Audit Metadata