React Email Skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:42 AM UTC
• Version: 2.0.0

Overview

This React Email skill is mostly ordinary documentation, but it asks users to run mutable npm commands, including one that prompts for a Resend API key.

Install only if you are comfortable trusting the current npm packages fetched by `npx`. Prefer pinning reviewed package versions, running setup in a clean project environment, using a narrowly scoped and revocable Resend API key, and rotating the key if setup behavior looks unexpected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned create-email Package Is Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

sh

npx create-email@latest

Technical Analysis

The command downloads and executes the version of create-email currently referenced by the mutable latest npm distribution tag. Because no exact version or integrity value is specified, the code executed by users can change after this Skill has been reviewed.

The package is consistent with the Skill's declared React Email functionality, and the audit found no evidence that the current package or instruction is intentionally malicious. Nevertheless, directly executing an unpinned package creates a supply-chain trust boundary: a compromised npm publisher account, package release process, or registry response could substitute attacker-controlled code.

Attack Path

1. An attacker compromises the package publisher, release pipeline, or npm package distribution.
2. The attacker publishes a malicious release and assigns it to the latest tag.
3. A user follows the Skill's installation instructions.
4. npx downloads and executes the malicious package without a fixed-version review boundary.
5. The package executes with the invoking user's local permissions and can access resources available to that process.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user running npx. Depending on the execution environment, this may expose project files, writable user files, environment variables, developer credentials, and network-accessible services. It does not inherently provide elevated operating-system privileges unless the command is run from an already privileged account.

Remediation

View remediation

Remediation Suggestions

• Replace the mutable latest tag with an exact, reviewed package version:

  sh

  npx create-email@<reviewed-exact-version>
  

• Record the approved version in the Skill and periodically review updates before changing it.
• Prefer a lockfile-backed installation workflow where practical.
• Verify package provenance, publisher identity, release signatures or attestations, and npm integrity metadata before execution.
• Run project scaffolding under a non-privileged account and in an isolated workspace without unrelated secrets in the environment.

T08 · Insecure Dependencies

Error

• Location: references/SENDING.md:57

Finding

Unpinned react-email Package Handles Resend Setup Credentials

Content

View full analysis

Vulnerability Details

File Location: references/SENDING.md:57-60
Vulnerability Type: Unpinned third-party package execution in a credential-handling workflow
Risk Level: High

Vulnerable Code

bash

npx react-email@latest resend setup

The accompanying instruction states:

This will require the user to provide a Resend API key in the terminal.

Technical Analysis

This workflow downloads and executes the package version referenced by the mutable latest npm tag, then asks the user to provide a Resend API key. Although use of Resend is directly related to the Skill's declared email-sending purpose and no deliberate credential theft was found, the combination of unpinned remote package execution and immediate secret handling increases supply-chain risk.

A malicious or compromised release could read the entered API key, inspect process environment variables, alter local configuration, or transmit credentials and project data to an attacker-controlled destination. The reviewed documentation does not provide a fixed-version review boundary or integrity-verification step before the credential is supplied.

Attack Path

1. An attacker compromises the react-email npm publisher account, release pipeline, or package distribution.
2. The attacker publishes a malicious version and causes the latest tag to reference it.
3. A user executes the documented npx react-email@latest resend setup command.
4. npx retrieves and runs the attacker-controlled package with the user's permissions.
5. The setup workflow prompts the user for a Resend API key.
6. Malicious package code captures the key and may exfiltrate it or store it insecurely.
7. The attacker uses the stolen key according to the permissions assigned to it, potentially sending unauthorized email or accessing other API capabilities available to that credential.

Impact Assessment

Local impact may include arbitrary code execution ...[truncated 516 chars]

Remediation

View remediation

Remediation Suggestions

• Replace latest with an exact version that has been reviewed:

  bash

  npx react-email@<reviewed-exact-version> resend setup
  

• Verify package provenance, integrity metadata, publisher identity, and release attestations before running the setup command.
• Separate package installation and validation from credential entry. Inspect and approve the installed version before providing any API key.
• Use a narrowly scoped, revocable setup credential where the provider supports it rather than a broad production key.
• Run setup from a non-privileged, isolated environment that does not contain unrelated credentials.
• Document where the CLI stores the key, require restrictive file permissions, and ensure credential files are excluded from version control.
• Rotate the key immediately if package integrity is uncertain or unexpected package behavior occurs.
• Monitor provider audit logs and sending activity for unauthorized use.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md

See [references/I18N.md](references/I18N.md) for complete i18n documentation. React Email supports three libraries: next-intl, react-i18next, and react-intl.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

md

See [references/I18N.md](references/I18N.md) for complete i18n documentation. React Email supports three libraries: next-intl, react-i18next, and react-intl.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to execute npx create-email@latest, which fetches and runs remote code without a pinned, reviewable version. If the upstream package is compromised, a malicious release is published, or a dependency hijack occurs, users could execute attacker-controlled code during project setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation instructs users to run npx react-email@latest resend setup, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed version. If the package or one of its delivery paths were compromised, users could execute unintended code on their machine during setup, and the file's explicit note that the command will prompt for a Resend API key increases the sensitivity of that execution context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The example sets <Html lang="en">, which implicitly fixes the email language to English. This reference file does not indicate that language should be chosen based on user preference or locale, and similar English-only examples recur elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This example uses <Html lang="en" dir="ltr">, again prescribing English and left-to-right text direction as the default example. Because the document presents this as a general reference, it risks encouraging a fixed locale without user or region-specific selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The Markdown example specifies <Html lang="en" dir="ltr"> without noting that these values should vary by recipient locale. In a generic reference document, this can be read as a recommended default rather than an illustrative placeholder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file embeds code examples that explicitly format dates using default locale behavior and en-US, while the surrounding content does not indicate that the templates are intentionally U.S.-specific. That creates a natural-language locale policy concern because the examples implicitly force one locale rather than offering configurability or documenting the limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code sample uses toLocaleString('en-US', ...), which forces U.S. English formatting for all recipients. Under the stated policy criteria, a fixed language/locale without user opt-in or documented justification is a reportable policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.