Skills
skills/alirezarezvani/claude-skills/email-template-builder/Gen Agent Trust Hub

email-template-builder

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection due to its handling of untrusted data in templates.
  • Ingestion points: The WelcomeEmail and InvoiceEmail templates in SKILL.md ingest external properties such as name, confirmUrl, and items.
  • Capability inventory: The skill includes logic in emails/lib/send.ts to render these templates and dispatch them via the resend.emails.send service.
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent or the rendering engine to ignore potentially malicious instructions embedded within the user-supplied data fields.
  • Sanitization: While the templates use standard React JSX, which provides escaping for Cross-Site Scripting (XSS), there is no specific sanitization or validation of the content to prevent it from influencing the agent's behavior if the output is re-processed by an AI.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 02:24 PM
Security Audit — agent-trust-hub — email-template-builder