skills/nanocoai/nanoclaw/add-resend/Gen Agent Trust Hub

add-resend

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell-based build and verification steps including pnpm run build and vitest. It also performs administrative configuration using the ncl CLI, such as creating users, granting the owner role, and establishing messaging wirings.
  • [EXTERNAL_DOWNLOADS]: Downloads and installs the @resend/chat-sdk-adapter package. This is a legitimate dependency for a well-known email service provider.
  • [PROMPT_INJECTION]: By enabling email communication, the skill creates an ingestion point for external, untrusted data.
  • Ingestion points: Data enters via the Resend webhook endpoint and incoming email message threads.
  • Boundary markers: Not explicitly defined in the skill instructions; relies on the agent platform's internal handling.
  • Capability inventory: The agent context includes access to the ncl CLI for user and group management, and file system access for .env configuration.
  • Sanitization: Not specified within the skill logic.
  • [SAFE]: The skill manages sensitive API keys and webhook secrets by prompting the user and storing them in a local .env file, which is the recommended practice for this environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 03:11 AM
Security Audit — agent-trust-hub — add-resend