react-email-skill
Fail
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the external domains 'talent-architect.com' and 'cdn.talent-architect.com', which have been flagged as malicious (phishing) by automated scanners (URLite). These domains are used as example verification links and asset hosts within the email templates.
- [EXTERNAL_DOWNLOADS]: The code examples include URLs with suspicious trailing whitespace (e.g., 'https://talent-architect.com/verify/abc123 ') which is a known adversarial technique used to bypass security filters and URL matching patterns.
- [REMOTE_CODE_EXECUTION]: The skill instructs users to run 'npx create-email@latest', which downloads and executes code from the public npm registry at runtime.
- [COMMAND_EXECUTION]: Provides instructions for running local shell commands such as 'npm install' and 'npm run dev' to set up the development environment, which can lead to the execution of arbitrary scripts defined in dependencies.
- [DATA_EXFILTRATION]: Implements email transmission using the Resend API. While functional for the skill's purpose, this involves transmitting data (user emails and content) to an external network endpoint outside of standard whitelisted services.
Recommendations
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata