The Agent Skills Directory

[SAFE]: The skill consistently recommends and demonstrates the use of environment variables (e.g., SMTP_PASS, RESEND_API_KEY) for secret management, explicitly advising against hardcoding credentials in configuration files.
[SAFE]: Transactional patterns, such as magic links, implement advanced security measures like token hashing (storing only hashes in the database while sending plain tokens via email) to protect against database compromises.
[SAFE]: Email templates use standard EJS escaping (<%= %>) for user-provided data, and the documentation explicitly warns about the risks of raw output to prevent Cross-Site Scripting (XSS) vulnerabilities.
[SAFE]: Security-sensitive workflows, such as password resets and magic links, are designed to prevent email enumeration attacks by returning uniform responses to the user regardless of whether the account exists.
[SAFE]: The skill includes robust logic for token lifecycle management, including cryptographic randomness for generation, expiration checks, and immediate invalidation after use to mitigate replay attacks.
[SAFE]: Dependencies such as sails-hook-mail, nodemailer, and resend are well-known, industry-standard libraries for the stated purpose of the skill.

email