The Agent Skills Directory

[SAFE]: The skill provides comprehensive documentation and templates for the React Email framework, adhering to standard development practices.
[INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where untrusted data (props, editor content) is processed for email rendering and delivery via network APIs. This surface is inherent to templating systems and is documented through typed interfaces.
Ingestion points: Template properties (e.g., WelcomeEmailProps in COMPONENTS.md) and the content prop in @react-email/editor (PATTERNS.md).
Boundary markers: Absent; the instructions do not specify delimiters for untrusted input.
Capability inventory: Network operations via Resend, Nodemailer, SendGrid, and Mailgun; file operations via email export (RENDERING-AND-SENDING.md).
Sanitization: Absent; the skill relies on standard React interpolation mechanisms which provide basic protection.
[DYNAMIC_EXECUTION]: The skill documents the use of --esbuild-plugins and custom visual editor extensions, allowing for the execution of developer-supplied code during bundling and rendering processes as a core framework feature (SETUP.md, PATTERNS.md).
[COMMAND_EXECUTION]: The skill documents the use of the react-email CLI, including commands for local development (email dev), production builds (email build), and exporting templates to static files (email export) (SETUP.md).
[CREDENTIALS_UNSAFE]: The skill documentation mentions the email resend setup command, which stores an API key in a configuration file within the user's home directory. This is presented as standard behavior for the official CLI tool and is documented neutrally (SETUP.md).

react-email