ClawHub
Back to skill

Security audit

Resend Email Sender

Security checks for vulnerabilities and agentic risk

Overview

This is a real Resend email-sending skill, but it has review-worthy scoping and safety issues around shared environment files, API key exposure, and live outbound emails.

Review before installing. Use a Resend key with the minimum available permissions, avoid placing unrelated secrets in the same .env file, and require explicit user confirmation of recipients and content before agents send emails, especially bulk, CC, or BCC messages.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/send_email.py:13
Finding

Overbroad Loading and Inheritance of Sensitive Environment Variables

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_email.py:70
Finding

Resend API Key Exposed in Subprocess Command-Line Arguments

Content
View full analysis
` included in its argument vector. 3. While `curl` is running, a local actor or monitoring component with sufficient process-inspection access reads the command line. 4. The actor extracts the bearer token from the authorization-header argument. 5. The actor submits independent requests to the Resend API using the stolen key. 6. Unauthorized activity continues until the key is revoked, expires, or reaches an account limit. Successful exploitation depends on local process visibility and timing. The co ...[truncated 647 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 15)May include surrounding context.

python
def load_env():
    """Load environment from .env files."""
    paths = [
        Path.home() / '.openclaw' / 'workspace' / '.env',
        Path('.env').resolve(),

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 41)May include surrounding context.

python
def load_env():
    """Load environment from .env files."""
    paths = [
        Path.home() / '.openclaw' / 'workspace' / '.env',
        Path('.env').resolve(),

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 17)May include surrounding context.

python
def load_env():
    """Load environment from .env files."""
    paths = [
        Path.home() / '.openclaw' / 'workspace' / '.env',
        Path('.env').resolve(),
    ]
    for path in paths:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 18)May include surrounding context.

python
def load_env():
    """Load environment from .env files."""
    paths = [
        Path.home() / '.openclaw' / 'workspace' / '.env',
        Path('.env').resolve(),
    ]
    for path in paths:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill exposes shell and environment-variable capabilities but does not declare any tool scope or permission boundaries in its manifest. This increases the chance that an agent can invoke external commands and access secrets without clear review or policy enforcement, which is especially risky for a skill that sends outbound communications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description does not warn that recipient addresses, subject lines, and message bodies are transmitted to Resend, a third-party email provider. Users or agents may therefore send sensitive or regulated information externally without informed consent, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The agent-facing example encourages direct execution to send email but omits any warning that this performs a real outbound action to live recipients. In an autonomous or semi-autonomous setting, that can lead to unintended notifications, spam, data leakage, or reputational harm if the agent triggers the skill without explicit confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_email.py (reported line 11)May include surrounding context.

python
import sys
from pathlib import Path

RESEND_API_URL = "https://api.resend.com/emails"


def load_env():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends email content, recipients, and related metadata to the Resend API via an external network call. While the module and function names indicate email sending, there is no explicit user-facing disclosure in the CLI flow warning that supplied data will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Using an external curl subprocess gives the skill unnecessary process-execution capability for a task that only requires an HTTPS POST. While there is no obvious shell injection here, relying on an external binary increases attack surface through PATH hijacking, environment manipulation, and operational policy bypass compared with direct in-process HTTP requests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_email.py (reported line 81)May include surrounding context.

python
'-d', json.dumps(payload)
        ]
        
        result = subprocess.run(curl_cmd, capture_output=True, text=True)
        
        if result.returncode == 0:
            try:

Static analysis

No suspicious patterns detected.