send-email
Facilitates sending transactional and bulk emails using the Resend API, ensuring best practices for delivery and error handling.
Install this skill
Security score
The send-email skill was audited on May 24, 2026 and we found 15 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 117 | { idempotencyKey: `welcome-email/${userId}` } |
Template literal with variable interpolation in command context
| 170 | { idempotencyKey: `batch-orders/${batchId}` } |
Webhook reference - potential data exfiltration
| 8 | - name: RESEND_WEBHOOK_SECRET |
Webhook reference - potential data exfiltration
| 9 | description: Webhook signing secret for verifying delivery event payloads (bounced, delivered, opened). Found in the Resend dashboard under Webhooks. |
Webhook reference - potential data exfiltration
| 236 | ## Webhooks (Event Notifications) |
Webhook reference - potential data exfiltration
| 238 | Track email delivery status in real-time using webhooks. Resend sends HTTP POST requests to your endpoint when events occur. |
Webhook reference - potential data exfiltration
| 247 | **CRITICAL: Always verify webhook signatures.** Without verification, attackers can send fake events to your endpoint. |
Webhook reference - potential data exfiltration
| 249 | See [references/webhooks.md](references/webhooks.md) for setup, signature verification code, and all event types. |
Webhook reference - potential data exfiltration
| 267 | - Correlate webhook events back to your application |
Webhook reference - potential data exfiltration
| 373 | **What happens:** Resend won't attempt delivery to suppressed addresses. The `email.suppressed` webhook event fires instead. |
Webhook reference - potential data exfiltration
| 390 | | Not verifying webhook signatures | Always verify - attackers can send fake events to your endpoint | |
Access to .env file
| 108 | const resend = new Resend(process.env.RESEND_API_KEY); |
Access to .env file
| 153 | const resend = new Resend(process.env.RESEND_API_KEY); |
External URL reference
| 6 | description: Resend API key for sending emails. Get yours at https://resend.com/api-keys |
External URL reference
| 204 | | **Links match sending domain** | If sending from `@acme.com`, link to `https://acme.com` - mismatched domains trigger spam filters | |