Resend CLI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Resend CLI helper, but it recommends unsafe remote installer execution, including in CI where an email API key is exposed to the installer step.

Review this skill before installing in any real Resend account or CI environment. Prefer pinned and verified CLI installation methods, keep RESEND_API_KEY scoped only to the send step, use least-privilege domain-scoped keys, and require explicit confirmation before sending email, batch sending, forwarding inbound mail, creating broadcasts, changing webhooks/domains, or creating/deleting API keys.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install-auth-and-profiles.md:8

Finding

Unverified Remote Installer Execution in Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: references/install-auth-and-profiles.md, lines 8–16
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code

markdown

| Environment | Good install choice |
| --- | --- |
| Generic macOS/Linux shell | `curl -fsSL https://resend.com/install.sh \| bash` |
| Node-heavy dev machine | `npm install -g resend-cli` |
| Homebrew-managed machine | `brew install resend/cli/resend` |
| Windows PowerShell | `irm https://resend.com/install.ps1 \| iex` |

Technical Analysis

The recommended Unix and Windows installation commands retrieve remotely mutable scripts and immediately execute them with bash or PowerShell. The instructions do not pin a release, save the script for inspection, or verify a checksum or cryptographic signature.

Although the scripts are hosted on the declared vendor domain, this does not provide artifact-level integrity. Compromise of the vendor website, CDN, DNS, TLS issuance, or installer publication process could change the effective code after this Skill has been reviewed.

These installation commands are relevant to the Skill's functionality, but immediate interpreter piping exceeds the minimum privilege and trust necessary to install the CLI safely. This file only documents the commands and does not execute them automatically.

Attack Path

1. An attacker compromises or gains influence over the remote installer delivery path.
2. A user or agent follows the documented curl | bash or irm | iex command.
3. The shell executes the remotely supplied content without integrity verification.
4. The payload inherits the invoking user's environment and filesystem permissions.
5. The payload can steal accessible credentials, alter files, install additional software, or modify subsequent CLI behavior.

Impact Assessment

Successful exploitation provides arbitrary code execution with ...[truncated 282 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all instructions that pipe network responses directly into an interpreter.
• Download a versioned release artifact to a local file before execution.
• Pin the expected CLI version rather than using a mutable installer endpoint.
• Verify a vendor-published SHA-256 checksum or cryptographic signature.
• Prefer a trusted, version-pinned package-manager installation where practical.
• For PowerShell, download the installer separately, validate its Authenticode signature or published hash, and only then invoke it.
• Explain the trust boundary and require explicit user approval before running any installer.

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/github-actions-resend.yml:7

Finding

Remote Installer Executes in CI with Job-Scoped API Credentials

Content

View full analysis

Vulnerability Details

File Location: assets/github-actions-resend.yml, lines 7–13
Vulnerability Type: Remote payload retrieval and execution in a credential-bearing CI job
Risk Level: Critical

Vulnerable Code

yaml

jobs:
  notify:
    runs-on: ubuntu-latest
    env:
      RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
    steps:
      - name: Install Resend CLI
        run: curl -fsSL https://resend.com/install.sh | bash

Technical Analysis

The workflow executes a mutable remote installer without version pinning or integrity verification. Because RESEND_API_KEY is defined at job scope, it is available to every step in the job, including the unverified installation script.

A compromised installer could read the API key directly from its inherited environment. It could also inspect other runner-accessible data, modify files in the workspace, place a spoofed resend executable in the installation directory, or influence later workflow steps.

The workflow is manually triggered, which limits automatic exposure, but does not mitigate the underlying supply-chain risk once the workflow is run.

Attack Path

1. An attacker compromises the mutable https://resend.com/install.sh response or its delivery infrastructure.
2. An authorized user triggers the GitHub Actions workflow.
3. The runner downloads the attacker's script and pipes it directly to bash.
4. The script reads the job-scoped RESEND_API_KEY from the environment.
5. The script exfiltrates the key or installs a malicious CLI executable.
6. The attacker uses the stolen key within its Resend permission scope, or the modified CLI compromises later workflow operations.

Impact Assessment

The immediate impact includes arbitrary code execution on the GitHub-hosted runner and disclosure of the Resend API key. Depending on the key's permissions, an attacker could send email, consume account resources, access permitte ...[truncated 340 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable installer with a version-pinned release artifact.

• Verify the artifact against a vendor-published checksum or cryptographic signature before installation.

• Pin third-party GitHub Actions and package versions to immutable commit hashes or exact versions where applicable.

• Move RESEND_API_KEY from job scope to the specific email-send step:

  yaml

  - name: Send notification email
    env:
      RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
    run: resend --json -q emails send ...
  

• Ensure the installation and verification steps run without access to application secrets.

• Use a narrowly scoped, domain-restricted, send-only Resend key for CI.

• Add explicit permissions to the workflow and grant only the GitHub token permissions the job requires.

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/resend_cli.py:72

Finding

Helper Promotes Mutable Remote Scripts as Preferred Installation Commands

Content

View full analysis

Vulnerability Details

File Location: scripts/resend_cli.py, lines 72–87
Vulnerability Type: Unsafe remote installer recommendations generated by executable helper code
Risk Level: High

Vulnerable Code

python

def install_hints() -> list[dict[str, str]]:
    system = platform.system().lower()
    hints = [
        {"method": "curl", "command": "curl -fsSL https://resend.com/install.sh | bash"},
        {"method": "npm", "command": "npm install -g resend-cli"},
        {"method": "brew", "command": "brew install resend/cli/resend"},
        {"method": "powershell", "command": "irm https://resend.com/install.ps1 | iex"},
    ]
    if system == "windows":
        order = ["powershell", "npm", "curl", "brew"]
    elif system == "darwin":
        order = ["brew", "curl", "npm", "powershell"]
    else:
        order = ["curl", "npm", "brew", "powershell"]

Technical Analysis

The helper does not itself execute these installer commands. However, it emits them through probe and CLI-not-found error responses, and ranks direct remote execution as the preferred option on Linux and PowerShell.

This is security-relevant in an agent-oriented Skill because another agent may treat the returned command as an actionable installation instruction. The commands provide no immutable version, checksum, signature check, or inspection step. Consequently, their effective payload can change independently of the audited Skill package.

The helper's actual subprocess invocation uses an argument array and does not enable shell execution, so no command injection was confirmed in cmd_run. The vulnerability is specifically the promotion of unsafe installation commands.

Attack Path

1. An agent runs python3 scripts/resend_cli.py probe or attempts run without the Resend CLI installed.
2. The helper returns a platform-prioritized installation command.
3. The agent or user executes the suggested co ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

• Remove curl | bash and irm | iex from the generated installation hints.
• Emit a secure sequence that downloads an exact release artifact, verifies its hash or signature, and installs it separately.
• Include the expected CLI version in generated commands.
• Prefer a version-pinned package-manager command when verified release artifacts are unavailable.
• Mark installation as a separate, user-approved operation rather than an automatic next action.
• Do not recommend executing any downloaded content until its origin and integrity have been verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

- `assets/command-catalog.json` — command index with detail levels (`source_inspected`, `readme_confirmed`, `tree_confirmed`)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This command forwards an inbound email to another address, which is a safety-critical transmission of potentially sensitive user or system data. The note explains the feature behavior but does not warn that forwarding can disclose private contents to third parties or require authorization before use.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This is a direct external script fetch-and-execute pattern in CI. In the context of an agent/automation skill that operates Resend from terminal/CI, this is more dangerous because the workflow also provides an outbound email API key, so a compromised installer could steal credentials and send unauthorized mail or manipulate related Resend resources.

Content

Scanner excerpt · assets/github-actions-resend.yml (reported line 13)May include surrounding context.

yaml

RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
    steps:
      - name: Install Resend CLI
        run: curl -fsSL https://resend.com/install.sh | bash

      - name: Add CLI to PATH
        run: echo "$HOME/.resend/bin" >> "$GITHUB_PATH"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The pipe into bash removes any opportunity for review between fetch and execution and is a classic command-chaining anti-pattern. If the fetched content is altered, the runner will execute arbitrary shell commands immediately, which can compromise the CI environment and exfiltrate RESEND_API_KEY or other available tokens.

Content

Scanner excerpt · assets/github-actions-resend.yml (reported line 13)May include surrounding context.

yaml

RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
    steps:
      - name: Install Resend CLI
        run: curl -fsSL https://resend.com/install.sh | bash

      - name: Add CLI to PATH
        run: echo "$HOME/.resend/bin" >> "$GITHUB_PATH"

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The batch-send route contains vague numeric-only triggers like '100', '200', '250', and '70', which are highly likely to appear in unrelated user requests. In this skill, those weak signals can misroute an agent into preparing or executing bulk email sends, a high-risk action because it can cause accidental mass messaging, reputation damage, rate-limit issues, or unauthorized use of production sending capability.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · evals/evals.json (reported line 140)May include surrounding context.

json

"Mentions that domains update currently exposes TLS/open/click tracking",
        "Notes the ambiguity around receiving toggles",
        "Suggests inspecting local help or falling back if necessary",
        "Does not claim a definitely-supported receiving toggle without caveat"
      ]
    },
    {

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The explicit command curl -fsSL https://resend.com/install.sh | bash fetches and immediately executes remote code, which is a classic arbitrary-code-execution risk. Because this skill is meant for AI agents, terminal sessions, and CI jobs, users may run the command non-interactively, amplifying the blast radius if the remote content is ever malicious or tampered with.

Content

Scanner excerpt · references/install-auth-and-profiles.md (reported line 12)May include surrounding context.

md

| Environment | Good install choice |
| --- | --- |
| Generic macOS/Linux shell | `curl -fsSL https://resend.com/install.sh \| bash` |
| Node-heavy dev machine | `npm install -g resend-cli` |
| Homebrew-managed machine | `brew install resend/cli/resend` |
| Windows PowerShell | `irm https://resend.com/install.ps1 \| iex` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/command-catalog.json (reported line 160)May include surrounding context.

json

- Linux override: `$XDG_CONFIG_HOME/resend`
- Windows: `%APPDATA%/resend`

Credentials go in `credentials.json`. The README and source both indicate restrictive permissions:

- config directory: `0700`
- credentials file: `0600`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install-auth-and-profiles.md (reported line 81)May include surrounding context.

md

- Linux override: `$XDG_CONFIG_HOME/resend`
- Windows: `%APPDATA%/resend`

Credentials go in `credentials.json`. The README and source both indicate restrictive permissions:

- config directory: `0700`
- credentials file: `0600`

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The helper recommends curl ... | bash and irm ... | iex, which are classic pipe-to-shell installation patterns that execute remote code directly without verification. In an agent or CI setting, such guidance is more dangerous because it can be copied verbatim into automated execution flows, turning documentation into a remote code execution path if the remote host, network path, or content is compromised.

Content

Scanner excerpt · scripts/resend_cli.py (reported line 76)May include surrounding context.

python

def install_hints() -> list[dict[str, str]]:
    system = platform.system().lower()
    hints = [
        {"method": "curl", "command": "curl -fsSL https://resend.com/install.sh | bash"},
        {"method": "npm", "command": "npm install -g resend-cli"},
        {"method": "brew", "command": "brew install resend/cli/resend"},
        {"method": "powershell", "command": "irm https://resend.com/install.ps1 | iex"},

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

safe_env() clones the full parent process environment and passes it into subprocesses, which can propagate unrelated secrets, tokens, proxy settings, and attacker-influenced execution variables to the invoked CLI. In an agent/CI context this is especially risky because environments often contain many sensitive credentials, and the wrapper later captures and returns subprocess stdout/stderr, increasing the chance of secret exposure or misuse.

Content

Scanner excerpt · scripts/resend_cli.py (reported line 92)May include surrounding context.

python

def safe_env(extra: dict[str, str] | None = None) -> dict[str, str]:
    env = dict(os.environ)
    env.setdefault("RESEND_NO_UPDATE_NOTIFIER", "1")
    if extra:
        env.update(extra)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill clearly instructs an agent to perform live CLI operations involving shell execution, environment-secret use, file generation, and networked account mutations, but it does not declare any tool scope such as permissions or allowed-tools. In a skills system, that omission can let the agent invoke broader capabilities than reviewers or policy layers expect, increasing the chance of unintended state changes or secret exposure during Resend operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill promotes live state-changing email, domain, webhook, and API-key operations but does not prominently warn that these actions can send real emails, alter production account configuration, or consume quota. In agent-driven environments, that missing warning makes accidental execution more likely, especially because the guidance emphasizes deterministic non-interactive automation and early execution of commands like doctor and later mutation flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This manifest entry documents a command that fetches full inbound email data, including message bodies and raw download URLs, which can expose private user communications and attachments. Although the capability is described, there is no accompanying warning or disclosure about handling sensitive content, privacy implications, or restricting use to authorized mailboxes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This command lists inbound attachment metadata and download URLs, which can reveal or enable access to sensitive files received by email. The description lacks any explicit warning that attachment access may expose private or regulated data and should be handled carefully.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow downloads and immediately executes a remote installer script with curl ... | bash, giving the remote server full code execution in the GitHub Actions runner. If the install endpoint, transport, or upstream distribution is compromised, the script can exfiltrate RESEND_API_KEY, tamper with the job, or pivot into other accessible CI secrets and artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The transactional-send route uses several broad natural-language triggers such as 'send email', 'notification', and 'reply in thread', which can match many unrelated requests and steer the agent toward a live email-sending command. In an agent/CLI automation context, incorrect routing increases the chance of unintended outbound email actions against a real Resend account, especially because the recommended sequence is immediately mutating rather than requiring confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation recommends piping remote installer scripts directly into a shell (curl ... | bash and irm ... | iex) without any warning or integrity-verification step. In an agent, terminal, or CI context, this is especially risky because it normalizes blind execution of network-fetched code, so a compromised upstream, MITM, or typo/redirect could lead to arbitrary code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The inbound mailbox and webhook recipes describe receiving email content, fetching attachments, and forwarding webhook data locally, but do not warn that these flows may process sensitive personal, confidential, or malicious content. In an agent-friendly terminal skill, that omission is more dangerous because it can normalize pulling live mailbox data and attachments into local or automated environments without privacy, retention, or malware-handling precautions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This documentation tells an agent how to send emails through an external provider but does not warn that recipient addresses, message bodies, attachments, headers, and related metadata will be transmitted to Resend. In an agent or CI context, that omission can lead to accidental disclosure of sensitive or regulated data because operators may treat the action as a local CLI operation rather than a third-party data transfer.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/resend_cli.py (reported line 152)May include surrounding context.

python

}
    if path:
        try:
            proc = subprocess.run(
                [path, "--version"],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This wrapper executes the external resend binary using user-controlled subcommand tokens, optional working directory, and caller-supplied environment values such as RESEND_API_KEY and RESEND_PROFILE. Although it avoids shell injection by passing an argument list to subprocess.run, it still creates a command-execution surface inside an agent skill; if an attacker can influence arguments or PATH resolution, the agent may perform unintended external actions, use attacker-chosen credentials, or invoke a trojaned resend executable.

Content

Scanner excerpt · scripts/resend_cli.py (reported line 540)May include surrounding context.

python

env["RESEND_PROFILE"] = args.profile

    try:
        proc = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The workflow reads RESEND_API_KEY from secrets at L10 and then uses it to send an email via the Resend CLI at L23. Although this is consistent with the workflow's purpose, the file itself provides no comment or warning that it accesses credentials and sends an external network request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template declares lang="en", which hard-codes English as the document language. Under the policy rule for natural-language violations, this is a locale choice without any visible opt-in or justification in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The recipe includes live-action examples for sending email and creating API keys against an external service without any caution that these commands can trigger real outbound messages or expose sensitive credentials in agent, terminal, or CI contexts. In an automation-oriented skill, that omission increases the chance of accidental production actions, misuse of real recipient addresses, or unsafe handling of newly created secrets.

Content

No source excerpt is available for this finding.