react-email
Verdict safe, but 2 findings (2 medium), mainly command injection, prompt injection. Most recent scan 2026-02-07.
The react-email skill presents MEDIUM security risks primarily related to command execution safety and prompt injection. The skill requires executing arbitrary shell commands to scaffold projects and install dependencies from npm, which introduces supply chain risks. The 'EXECUTE NOW' directive in the instructions attempts direct prompt injection to force immediate execution without user confirmation. The skill also starts an unbounded development server without lifecycle management guidance. However, the skill's core functionality (creating email templates with React) is legitimate, and the referenced files contain standard documentation without malicious content. The internal reference files (COMPONENTS.md, PATTERNS.md, I18N.md, SENDING.md) are normal skill resources and not security threats. Missing optional metadata (allowed-tools, compatibility) reduces transparency but is not a critical issue. With proper safeguards around command execution and removal of imperative directives, this skill could be used safely.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Create beautiful, responsive HTML emails using React components with React Email. Build transactional emails with modern components, support internationalization, and integrate with email service providers like Resend. Use when creating welcome emails, password resets, notifications, order confirmations, or any HTML email templates.
- Package
- 6 files, 64 KB
- SKILL.md
- 1672 words, 12+ sections
- Code
- None. Instructions only.
- License
- MIT
SKILL.md covers: React Email · Installation · Navigate to Project Directory · Install Dependencies · Start the Development Server · Verify Installation · Notes on installation · tsconfig.json updating or creation · Basic Email Template · Essential Components · Behavioral guidelines · Styling considerations
Findings
MEDIUM Command Injection Risk via Unvalidated Package Manager Execution Command Injectionllm
The skill instructs the agent to execute arbitrary shell commands (npx, yarn, pnpm, bun) to scaffold a new project and install dependencies without any validation or sandboxing. The commands use 'create-email@latest' which fetches and executes code from npm registry at runtime. An attacker could potentially compromise the npm package or perform typosquatting attacks. Additionally, the 'EXECUTE NOW' directive attempts to force immediate execution without user confirmation.
SKILL.md
npx create-email@latest
yarn create email
pnpm create email
bun create email
EXECUTE NOW: Complete the above TODO list to achieve: The React Email development server is running and accessible at localhost:3000, displaying email template previews.MEDIUM Direct Prompt Injection via 'EXECUTE NOW' Command Prompt Injectionllm
The SKILL.md instructions contain a direct prompt injection attempt using 'EXECUTE NOW: Complete the above TODO list' which tries to force the agent to immediately execute commands without user oversight. This directive attempts to override the agent's normal confirmation and safety mechanisms by issuing imperative commands.
SKILL.md:58
EXECUTE NOW: Complete the above TODO list to achieve: The React Email development server is running and accessible at localhost:3000, displaying email template previews.What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 1.7 KB |
SKILL.md | doc | 13 KB |
references/COMPONENTS.md | doc | 11 KB |
references/I18N.md | doc | 14 KB |
references/PATTERNS.md | doc | 22 KB |
references/SENDING.md | doc | 3.0 KB |
External hosts referenced
via.placeholder.com agentskills.io github.com react.email resend.com fonts.gstatic.com www.caniemail.com www.youtube.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
RESEND_API_KEY SENDGRID_API_KEY SMTP_PASS
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/react-email-skills
- Raw scan result: react-email-skills-scan.json
- Badge for your README:
- Request a re-scan