add-resend

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompts for the Resend API key and webhook signing secret and then directly injects those captured values into an nc:env-set directive (writing them verbatim into .env), which forces the agent to handle/output secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The “Add Resend Email Channel” skill provisions a Resend webhook endpoint where inbound emails (“email.received”) can be delivered as free-text from external correspondents, making that user-authored email body a runtime input the agent can ingest via the Resend→webhook path.