react-email
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of several official Node.js packages for email templating and internationalization, including
@react-email/components,resend,next-intl, andnodemailer. - [COMMAND_EXECUTION]: The skill uses standard CLI commands for project scaffolding (
npx create-email@latest), dependency management (npm, yarn, pnpm, bun), and running a local development server (npm run dev). - [CREDENTIALS_UNSAFE]: The skill follows security best practices by advising the use of environment variables (e.g.,
RESEND_API_KEY,SMTP_PASS) for managing API keys and SMTP credentials, avoiding hardcoded secrets. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a data ingestion surface where user-supplied content is interpolated into React components. It mitigates risks by instructing the agent to use JSX interpolation, providing explicit structural components, and enforcing restrictions against unsafe content types like SVGs.
- [SAFE]: All external references, such as Resend, React Email documentation, and email client support databases (caniemail.com), are legitimate industry resources.
Audit Metadata