T09 · Insecure Skill Coding Practices
Warning
- Location
references/api-keys.md:41- Finding
New API Keys and Webhook Signing Secrets Are Written to Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Resend Skills
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Resend API helper skill, but users should be careful with real email sends, account changes, logs, and secrets.
Install this only if you want agent assistance with Resend. Use least-privilege Resend keys, confirm any send/delete/key/webhook action before running it, avoid logging complete secrets, treat logs and attachments as sensitive, and pin SDK or external skill dependencies when your environment requires reproducible installs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
references/installation.md:1- Finding
Mutable Dependency Installation and Unreviewed External Skill Execution
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
references/receiving.md:224- Finding
Unbounded Download, In-Memory Encoding, and Forwarding of Untrusted Email Attachments
- Content
View full analysis
{ const res = await fetch(att.download_url); const buffer = Buffer.from(await res.arrayBuffer()); return { filename: att.filename, content: buffer.toString('base64'), }; }) ); // 4. Forward the email (single send — batch doesn't support attachments) await resend.emails.send({ from: 'Support System ', to: ['team@acme.com'], subject: `Fwd: ${email.subject}`, html: email.html, text: email.text, attachments, }); ``` Related example: ```typescript const response = await fetch(attachment.download_url); const buffer = await response.arrayBuffer(); await saveToStorage(attachment.filename, buffer); ``` ### Technical Analysis The forwarding example downloads every attachment concurrently with `Promise.all`, buffers each complete response in memory, creates an additional Base64 representation, and forwards the content without documented limits or security validation. The code does not enforce: - Maximum attachment count - Per-file or cumulative size limits - Download timeouts - MIME-type restrictions - Filename sanitization - Malware scanning - Redirect restrictions - Validation of the final download destination The Base64 operation is encoding, not decoding or execution. Therefore, the static pre-scan’s decode-and-execute warning is a false positive. However, the attachment bytes originate from untrusted inbound email senders and remain unsafe content. The signed URL is supplied by the Resend API, making the network request consistent with t ...[truncated 1573 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (37)
YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
resend-mx-value>
text If you set up Resend to receive email on a root domain, *all* traffic will be routed to Resend, not to any other mailbox. ## Webhook Setup ### Subscribe to `email.received` Dashboard → Webhooks → Add Webhook → Select `email.received` For local development, use tunneling (ngrok, Tailscale Funnel, VS Code Port Forwarding): ```bash ngrok http 3000 # Use https://abc123.ngrok.io/api/webhook as endpointWebhook Payload Structure
Important: Payload contains metadata only, not email body or attachment content.
json { "type": "email.received", "created_at": "2024-02-22T23:41:12.126Z", "data": { "email_id": "a1b2c3d4-...", "from": "sender@example.com", "to": ["support@acme.com"], "cc": [], "bcc": [], "subject": "Question about my order", "attachments": [ { "id": "att_abc123", "filename": "receipt.pdf", "content_type": "application/pdf" } ] } }Verify Webhook Sign
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Full SDK examples** (Node.js, Python, Go, cURL) | [sending/single-email-examples.md](references/sending/single-email-examples.md) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Idempotency, retries, error handling** | [sending/best-practices.md](references/sending/best-practices.md) |
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
Use triple mustache in HTML and subject:
{{{VARIABLE_NAME}}}html <!-- ✅ Correct --> <p>Hi {{{CUSTOMER_NAME}}}, your order #{{{ORDER_ID}}} has shipped!</p> <!-- ❌ Wrong — double braces don't render in Resend -->
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to 'Always use this skill when the user mentions Resend, even for simple tasks' is an overly broad activation rule that can trigger the skill in contexts where only incidental mention of Resend occurs. This can cause unnecessary access to email/API-key-oriented guidance and increase the chance of the agent taking higher-risk actions or prioritizing this skill over more appropriate, narrower workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file includes examples that create API keys, print the returned token, and delete a key, but it does not provide a user-facing warning about handling the token as a secret or about the impact of deleting keys. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The SDK methods table states that
resend.automations.remove(id)is permanent, but the document does not provide any broader warning about data loss, operational impact, or recommended safeguards. For markdown documentation, irreversible operations should include clear cautions because they can affect user data or system integrity.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown describes a
contact_deletestep as simply deleting the contact, but does not warn that this is destructive and potentially irreversible. Under the missing-warning rule for markdown files, destructive operations affecting user data should be accompanied by a clear warning.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a markdown file, so SQP-2 applies to missing user warnings in the skill description. The example encourages a one-call send operation to an audience segment, which can affect user data and system integrity, but the document does not include any explicit caution, confirmation, or privacy warning around that behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The Python example hardcodes an API key literal directly in source, which normalizes insecure secret-handling practices and increases the chance that real credentials will be embedded in code, committed to repositories, or exposed through logs and screenshots. In the context of an email API skill, leaked credentials could allow unauthorized sending, contact access, webhook manipulation, or broader account abuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file documents operations that create, update, retrieve, list, and remove contact records containing personal data such as email addresses and names. Under the markdown-specific warning criteria, the description should warn that these actions affect user data and that deletion/removal changes are potentially impactful.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Recommended: Store API key in environment variable `RESEND_API_KEY` rather than hardcoding. ## cURL (No SDK) For quick tests or languages without an SDK, use the REST API directly:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL
bash curl -s "https://api.resend.com/logs?limit=20" \ -H "Authorization: Bearer $RESEND_API_KEY" \ -H "User-Agent: curl"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL
bash curl -s "https://api.resend.com/logs?limit=20" \ -H "Authorization: Bearer $RESEND_API_KEY" \ -H "User-Agent: curl"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL
bash curl -s "https://api.resend.com/logs?limit=20" \ -H "Authorization: Bearer $RESEND_API_KEY" \ -H "User-Agent: curl"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL
bash curl -s "https://api.resend.com/logs?limit=20" \ -H "Authorization: Bearer $RESEND_API_KEY" \ -H "User-Agent: curl"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL
bash curl -s "https://api.resend.com/logs?limit=20" \ -H "Authorization: Bearer $RESEND_API_KEY" \ -H "User-Agent: curl"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL
bash curl -s "https://api.resend.com/logs?limit=20" \ -H "Authorization: Bearer $RESEND_API_KEY" \ -H "User-Agent: curl"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation explicitly states that a retrieved log includes full request and response bodies, and the example shows original email payload contents. In the context of an email API, those bodies can contain recipient addresses, message content, tokens, API responses, and other sensitive operational data; documenting access without warning about sensitivity, retention, redaction, or access control encourages unsafe handling of logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example downloads attachments from externally sourced emails and stores them directly without warning that the content is untrusted. This can lead downstream users to persist malicious files or process them unsafely, increasing risk of malware handling, phishing payload retention, or unsafe later consumption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file provides multiple ready-to-use examples that send batches of emails via the Resend API, including recipient addresses and message content, but it does not include any user-facing warning about transmitting potentially sensitive data to an external provider. Under the markdown-file criteria for missing user warnings, descriptions that enable actions affecting user data or privacy should disclose those risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file documents multiple examples that send email content and recipient addresses to the Resend API, which is a network operation affecting user data and privacy. Under the markdown-specific SQP-2 criteria, the description should include a warning or disclosure about sending data to a third-party email service, but no such warning appears in the file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file documents listing and downloading email attachments, including use of a signed
download_url, but it does not warn that attachments may contain sensitive user data or that downloading them can affect privacy and data handling. Under the markdown-file criteria for missing user warnings, behaviors that access or retrieve user data should include a clear warning about sensitivity and careful handling.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The section explains open and click tracking mechanics and configuration recommendations, but omits an explicit warning that enabling tracking may require user consent and compliance with privacy laws and internal policies. In an email-sending skill, this omission is more dangerous because it can normalize deployment of behavioral tracking without legal review, leading to unauthorized monitoring and regulatory exposure.
- Content
Static analysis
No suspicious patterns detected.