email-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as an educational and technical resource for developers building email systems. It emphasizes security best practices such as SPF/DKIM/DMARC authentication and provides reliable patterns for transactional email delivery.
- [EXTERNAL_DOWNLOADS]: The documentation mentions industry-standard libraries and tools, including 'svix' for secure webhook processing and 'ngrok' for development environments. These references are appropriate for the skill's purpose.
- [PROMPT_INJECTION]: The skill outlines logic for processing external webhook data, which constitutes an indirect prompt injection surface. The analysis confirmed the following details regarding this surface:
- Ingestion points: Webhook payloads are received via POST requests at application endpoints, as described in 'resources/webhooks-events.md'.
- Boundary markers: The skill provides technical templates rather than natural language prompts; it does not include explicit delimiters for email content but focuses on transport-level security.
- Capability inventory: Code examples include network operations for sending emails ('resend.emails.send') and database writes for maintaining suppression lists ('db.suppressions.upsert').
- Sanitization: The instructions proactively mitigate risks by providing implementation details for cryptographic signature verification using the 'svix' library to ensure the integrity and authenticity of external data.
Audit Metadata