Resend CLI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Resend CLI helper, but it recommends unsafe remote installer execution, including in CI where an email API key is exposed to the installer step.

Review this skill before installing in any real Resend account or CI environment. Prefer pinned and verified CLI installation methods, keep RESEND_API_KEY scoped only to the send step, use least-privilege domain-scoped keys, and require explicit confirmation before sending email, batch sending, forwarding inbound mail, creating broadcasts, changing webhooks/domains, or creating/deleting API keys.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install-auth-and-profiles.md:8
• Finding: Unverified Remote Installer Execution in Installation Guidance## Vulnerability Details **File Location**: `references/install-auth-and-profiles.md`, lines 8–16 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```markdown | Environment | Good install choice | | --- | --- | | Generic macOS/Linux shell | `curl -fsSL https://resend.com/install.sh \| bash` | | Node-heavy dev machine | `npm install -g resend-cli` | | Homebrew-managed machine | `brew install resend/cli/resend` | | Windows PowerShell | `irm https://resend.com/install.ps1 \| iex` | ``` ### Technical Analysis The recommended Unix and Windows installation commands retrieve remotely mutable scripts and immediately execute them with `bash` or PowerShell. The instructions do not pin a release, save the script for inspection, or verify a checksum or cryptographic signature. Although the scripts are hosted on the declared vendor domain, this does not provide artifact-level integrity. Compromise of the vendor website, CDN, DNS, TLS issuance, or installer publication process could change the effective code after this Skill has been reviewed. These installation commands are relevant to the Skill's functionality, but immediate interpreter piping exceeds the minimum privilege and trust necessary to install the CLI safely. This file only documents the commands and does not execute them automatically. ### Attack Path 1. An attacker compromises or gains influence over the remote installer delivery path. 2. A user or agent follows the documented `curl | bash` or `irm | iex` command. 3. The shell executes the remotely supplied content without integrity verification. 4. The payload inherits the invoking user's environment and filesystem permissions. 5. The payload can steal accessible credentials, alter files, install additional software, or modify subsequent CLI behavior. ### Impact Assessment Successful exploitation provides arbitrary code execution with ...[truncated 282 chars]
• Remediation: ## Remediation Suggestions - Remove all instructions that pipe network responses directly into an interpreter. - Download a versioned release artifact to a local file before execution. - Pin the expected CLI version rather than using a mutable installer endpoint. - Verify a vendor-published SHA-256 checksum or cryptographic signature. - Prefer a trusted, version-pinned package-manager installation where practical. - For PowerShell, download the installer separately, validate its Authenticode signature or published hash, and only then invoke it. - Explain the trust boundary and require explicit user approval before running any installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/github-actions-resend.yml:7
• Finding: Remote Installer Executes in CI with Job-Scoped API Credentials## Vulnerability Details **File Location**: `assets/github-actions-resend.yml`, lines 7–13 **Vulnerability Type**: Remote payload retrieval and execution in a credential-bearing CI job **Risk Level**: Critical ### Vulnerable Code ```yaml jobs: notify: runs-on: ubuntu-latest env: RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }} steps: - name: Install Resend CLI run: curl -fsSL https://resend.com/install.sh | bash ``` ### Technical Analysis The workflow executes a mutable remote installer without version pinning or integrity verification. Because `RESEND_API_KEY` is defined at job scope, it is available to every step in the job, including the unverified installation script. A compromised installer could read the API key directly from its inherited environment. It could also inspect other runner-accessible data, modify files in the workspace, place a spoofed `resend` executable in the installation directory, or influence later workflow steps. The workflow is manually triggered, which limits automatic exposure, but does not mitigate the underlying supply-chain risk once the workflow is run. ### Attack Path 1. An attacker compromises the mutable `https://resend.com/install.sh` response or its delivery infrastructure. 2. An authorized user triggers the GitHub Actions workflow. 3. The runner downloads the attacker's script and pipes it directly to `bash`. 4. The script reads the job-scoped `RESEND_API_KEY` from the environment. 5. The script exfiltrates the key or installs a malicious CLI executable. 6. The attacker uses the stolen key within its Resend permission scope, or the modified CLI compromises later workflow operations. ### Impact Assessment The immediate impact includes arbitrary code execution on the GitHub-hosted runner and disclosure of the Resend API key. Depending on the key's permissions, an attacker could send email, consume account resources, access permitte ...[truncated 340 chars]
• Remediation: ## Remediation Suggestions - Replace the mutable installer with a version-pinned release artifact. - Verify the artifact against a vendor-published checksum or cryptographic signature before installation. - Pin third-party GitHub Actions and package versions to immutable commit hashes or exact versions where applicable. - Move `RESEND_API_KEY` from job scope to the specific email-send step: ```yaml - name: Send notification email env: RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }} run: resend --json -q emails send ... ``` - Ensure the installation and verification steps run without access to application secrets. - Use a narrowly scoped, domain-restricted, send-only Resend key for CI. - Add explicit permissions to the workflow and grant only the GitHub token permissions the job requires.

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/resend_cli.py:72
• Finding: Helper Promotes Mutable Remote Scripts as Preferred Installation Commands## Vulnerability Details **File Location**: `scripts/resend_cli.py`, lines 72–87 **Vulnerability Type**: Unsafe remote installer recommendations generated by executable helper code **Risk Level**: High ### Vulnerable Code ```python def install_hints() -> list[dict[str, str]]: system = platform.system().lower() hints = [ {"method": "curl", "command": "curl -fsSL https://resend.com/install.sh | bash"}, {"method": "npm", "command": "npm install -g resend-cli"}, {"method": "brew", "command": "brew install resend/cli/resend"}, {"method": "powershell", "command": "irm https://resend.com/install.ps1 | iex"}, ] if system == "windows": order = ["powershell", "npm", "curl", "brew"] elif system == "darwin": order = ["brew", "curl", "npm", "powershell"] else: order = ["curl", "npm", "brew", "powershell"] ``` ### Technical Analysis The helper does not itself execute these installer commands. However, it emits them through `probe` and CLI-not-found error responses, and ranks direct remote execution as the preferred option on Linux and PowerShell. This is security-relevant in an agent-oriented Skill because another agent may treat the returned command as an actionable installation instruction. The commands provide no immutable version, checksum, signature check, or inspection step. Consequently, their effective payload can change independently of the audited Skill package. The helper's actual subprocess invocation uses an argument array and does not enable shell execution, so no command injection was confirmed in `cmd_run`. The vulnerability is specifically the promotion of unsafe installation commands. ### Attack Path 1. An agent runs `python3 scripts/resend_cli.py probe` or attempts `run` without the Resend CLI installed. 2. The helper returns a platform-prioritized installation command. 3. The agent or user executes the suggested co ...[truncated 575 chars]
• Remediation: ## Remediation Suggestions - Remove `curl | bash` and `irm | iex` from the generated installation hints. - Emit a secure sequence that downloads an exact release artifact, verifies its hash or signature, and installs it separately. - Include the expected CLI version in generated commands. - Prefer a version-pinned package-manager command when verified release artifacts are unavailable. - Mark installation as a separate, user-approved operation rather than an automatic next action. - Do not recommend executing any downloaded content until its origin and integrity have been verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

Ae1

High

• Category: analysis-evasion

Content

- `assets/command-catalog.json` — command index with detail levels (`source_inspected`, `readme_confirmed`, `tree_confirmed`)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: This command forwards an inbound email to another address, which is a safety-critical transmission of potentially sensitive user or system data. The note explains the feature behavior but does not warn that forwarding can disclose private contents to third parties or require authorization before use.

External Script Fetching

High

• Category: Supply Chain

Content

RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
    steps:
      - name: Install Resend CLI
        run: curl -fsSL https://resend.com/install.sh | bash

      - name: Add CLI to PATH
        run: echo "$HOME/.resend/bin" >> "$GITHUB_PATH"

• Confidence: 99% confidence
• Finding: This is a direct external script fetch-and-execute pattern in CI. In the context of an agent/automation skill that operates Resend from terminal/CI, this is more dangerous because the workflow also provides an outbound email API key, so a compromised installer could steal credentials and send unauthorized mail or manipulate related Resend resources.

Chaining Abuse

High

• Category: Tool Misuse

Content

RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
    steps:
      - name: Install Resend CLI
        run: curl -fsSL https://resend.com/install.sh | bash

      - name: Add CLI to PATH
        run: echo "$HOME/.resend/bin" >> "$GITHUB_PATH"

• Confidence: 98% confidence
• Finding: The pipe into `bash` removes any opportunity for review between fetch and execution and is a classic command-chaining anti-pattern. If the fetched content is altered, the runner will execute arbitrary shell commands immediately, which can compromise the CI environment and exfiltrate `RESEND_API_KEY` or other available tokens.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The batch-send route contains vague numeric-only triggers like '100', '200', '250', and '70', which are highly likely to appear in unrelated user requests. In this skill, those weak signals can misroute an agent into preparing or executing bulk email sends, a high-risk action because it can cause accidental mass messaging, reputation damage, rate-limit issues, or unauthorized use of production sending capability.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

"Mentions that domains update currently exposes TLS/open/click tracking",
        "Notes the ambiguity around receiving toggles",
        "Suggests inspecting local help or falling back if necessary",
        "Does not claim a definitely-supported receiving toggle without caveat"
      ]
    },
    {

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

External Script Fetching

High

• Category: Supply Chain

Content

| Environment | Good install choice |
| --- | --- |
| Generic macOS/Linux shell | `curl -fsSL https://resend.com/install.sh \| bash` |
| Node-heavy dev machine | `npm install -g resend-cli` |
| Homebrew-managed machine | `brew install resend/cli/resend` |
| Windows PowerShell | `irm https://resend.com/install.ps1 \| iex` |

• Confidence: 98% confidence
• Finding: The explicit command `curl -fsSL https://resend.com/install.sh | bash` fetches and immediately executes remote code, which is a classic arbitrary-code-execution risk. Because this skill is meant for AI agents, terminal sessions, and CI jobs, users may run the command non-interactively, amplifying the blast radius if the remote content is ever malicious or tampered with.

Credential Access

High

• Category: Privilege Escalation

Content

- Linux override: `$XDG_CONFIG_HOME/resend`
- Windows: `%APPDATA%/resend`

Credentials go in `credentials.json`. The README and source both indicate restrictive permissions:

- config directory: `0700`
- credentials file: `0600`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Linux override: `$XDG_CONFIG_HOME/resend`
- Windows: `%APPDATA%/resend`

Credentials go in `credentials.json`. The README and source both indicate restrictive permissions:

- config directory: `0700`
- credentials file: `0600`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

def install_hints() -> list[dict[str, str]]:
    system = platform.system().lower()
    hints = [
        {"method": "curl", "command": "curl -fsSL https://resend.com/install.sh | bash"},
        {"method": "npm", "command": "npm install -g resend-cli"},
        {"method": "brew", "command": "brew install resend/cli/resend"},
        {"method": "powershell", "command": "irm https://resend.com/install.ps1 | iex"},

• Confidence: 99% confidence
• Finding: The helper recommends `curl ... | bash` and `irm ... | iex`, which are classic pipe-to-shell installation patterns that execute remote code directly without verification. In an agent or CI setting, such guidance is more dangerous because it can be copied verbatim into automated execution flows, turning documentation into a remote code execution path if the remote host, network path, or content is compromised.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def safe_env(extra: dict[str, str] | None = None) -> dict[str, str]:
    env = dict(os.environ)
    env.setdefault("RESEND_NO_UPDATE_NOTIFIER", "1")
    if extra:
        env.update(extra)

• Confidence: 97% confidence
• Finding: `safe_env()` clones the full parent process environment and passes it into subprocesses, which can propagate unrelated secrets, tokens, proxy settings, and attacker-influenced execution variables to the invoked CLI. In an agent/CI context this is especially risky because environments often contain many sensitive credentials, and the wrapper later captures and returns subprocess stdout/stderr, increasing the chance of secret exposure or misuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs an agent to perform live CLI operations involving shell execution, environment-secret use, file generation, and networked account mutations, but it does not declare any tool scope such as permissions or allowed-tools. In a skills system, that omission can let the agent invoke broader capabilities than reviewers or policy layers expect, increasing the chance of unintended state changes or secret exposure during Resend operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill promotes live state-changing email, domain, webhook, and API-key operations but does not prominently warn that these actions can send real emails, alter production account configuration, or consume quota. In agent-driven environments, that missing warning makes accidental execution more likely, especially because the guidance emphasizes deterministic non-interactive automation and early execution of commands like doctor and later mutation flows.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This manifest entry documents a command that fetches full inbound email data, including message bodies and raw download URLs, which can expose private user communications and attachments. Although the capability is described, there is no accompanying warning or disclosure about handling sensitive content, privacy implications, or restricting use to authorized mailboxes.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This command lists inbound attachment metadata and download URLs, which can reveal or enable access to sensitive files received by email. The description lacks any explicit warning that attachment access may expose private or regulated data and should be handled carefully.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow downloads and immediately executes a remote installer script with `curl ... | bash`, giving the remote server full code execution in the GitHub Actions runner. If the install endpoint, transport, or upstream distribution is compromised, the script can exfiltrate `RESEND_API_KEY`, tamper with the job, or pivot into other accessible CI secrets and artifacts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The transactional-send route uses several broad natural-language triggers such as 'send email', 'notification', and 'reply in thread', which can match many unrelated requests and steer the agent toward a live email-sending command. In an agent/CLI automation context, incorrect routing increases the chance of unintended outbound email actions against a real Resend account, especially because the recommended sequence is immediately mutating rather than requiring confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation recommends piping remote installer scripts directly into a shell (`curl ... | bash` and `irm ... | iex`) without any warning or integrity-verification step. In an agent, terminal, or CI context, this is especially risky because it normalizes blind execution of network-fetched code, so a compromised upstream, MITM, or typo/redirect could lead to arbitrary code execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The inbound mailbox and webhook recipes describe receiving email content, fetching attachments, and forwarding webhook data locally, but do not warn that these flows may process sensitive personal, confidential, or malicious content. In an agent-friendly terminal skill, that omission is more dangerous because it can normalize pulling live mailbox data and attachments into local or automated environments without privacy, retention, or malware-handling precautions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation tells an agent how to send emails through an external provider but does not warn that recipient addresses, message bodies, attachments, headers, and related metadata will be transmitted to Resend. In an agent or CI context, that omission can lead to accidental disclosure of sensitive or regulated data because operators may treat the action as a local CLI operation rather than a third-party data transfer.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

}
    if path:
        try:
            proc = subprocess.run(
                [path, "--version"],
                capture_output=True,
                text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env["RESEND_PROFILE"] = args.profile

    try:
        proc = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 95% confidence
• Finding: This wrapper executes the external `resend` binary using user-controlled subcommand tokens, optional working directory, and caller-supplied environment values such as `RESEND_API_KEY` and `RESEND_PROFILE`. Although it avoids shell injection by passing an argument list to `subprocess.run`, it still creates a command-execution surface inside an agent skill; if an attacker can influence arguments or PATH resolution, the agent may perform unintended external actions, use attacker-chosen credentials, or invoke a trojaned `resend` executable.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The workflow reads RESEND_API_KEY from secrets at L10 and then uses it to send an email via the Resend CLI at L23. Although this is consistent with the workflow's purpose, the file itself provides no comment or warning that it accesses credentials and sends an external network request.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The template declares `lang="en"`, which hard-codes English as the document language. Under the policy rule for natural-language violations, this is a locale choice without any visible opt-in or justification in the file.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The recipe includes live-action examples for sending email and creating API keys against an external service without any caution that these commands can trigger real outbound messages or expose sensitive credentials in agent, terminal, or CI contexts. In an automation-oriented skill, that omission increases the chance of accidental production actions, misuse of real recipient addresses, or unsafe handling of newly created secrets.

Static analysis

No suspicious patterns detected.