Security audit

Resend Send Native Node

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, send-only Resend email helper that defaults to dry-run and requires both explicit send flags and recipient allowlisting for real emails.

Install only if you want a Codex skill that can send email through your Resend account. Keep RESEND_ALLOWED_TO narrow, review the dry-run payload before using --send, and remember that dry-run logs include the full message body even though the API key is redacted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/run-resend-send-tests.mjs:11

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/send.mjs:19