Most static findings are false positives from Markdown code formatting and relative documentation links. Two documented helper invocations execute unreviewed connector scripts, and one helper receives RESEND_API_KEY; these require verification and explicit user confirmation before use.
2
Files scanned
141
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
The Resend connector is explicitly invoked with access to RESEND_API_KEY. Secret access by an unreviewed external helper presents a credential-exposure risk.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
The skill instructs the host to execute a Python connector located under CLAUDE_PLUGIN_ROOT. The connector source is outside the two scanned files, so its behavior cannot be verified before it receives account access.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
The skill instructs the host to run an external DNS-over-HTTPS connector with a supplied domain argument. The connector source is not in the scanned files, so input handling and network behavior cannot be verified.
Most static findings are false positives from Markdown code formatting and relative documentation links. Two documented helper invocations execute unreviewed connector scripts, and one helper receives RESEND_API_KEY; these require verification and explicit user confirmation before use.
2
Files scanned
141
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
The Resend connector is explicitly invoked with access to RESEND_API_KEY. Secret access by an unreviewed external helper presents a credential-exposure risk.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
The skill instructs the host to execute a Python connector located under CLAUDE_PLUGIN_ROOT. The connector source is outside the two scanned files, so its behavior cannot be verified before it receives account access.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
The skill instructs the host to run an external DNS-over-HTTPS connector with a supplied domain argument. The connector source is not in the scanned files, so input handling and network behavior cannot be verified.
Most static alerts are false positives caused by Markdown backticks and fixed relative documentation links. Two lines explicitly invoke external Python connectors for Resend and DNS-over-HTTPS checks. The connector implementations are outside this scanned package, so their behavior cannot be verified here.
2
Files scanned
141
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
Line 52 explicitly instructs the agent to launch a Python Resend connector. The referenced script is outside the scanned package and uses account credentials, so its behavior cannot be verified.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
Line 54 explicitly invokes a Python DNS-over-HTTPS connector with a supplied domain. This creates real process and network activity through code not included in the scanned package.
Most static alerts are false positives caused by Markdown backticks and fixed relative documentation links. Two lines explicitly invoke external Python connectors for Resend and DNS-over-HTTPS checks. The connector implementations are outside this scanned package, so their behavior cannot be verified here.
2
Files scanned
141
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
Line 52 explicitly instructs the agent to launch a Python Resend connector. The referenced script is outside the scanned package and uses account credentials, so its behavior cannot be verified.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
Line 54 explicitly invokes a Python DNS-over-HTTPS connector with a supplied domain. This creates real process and network activity through code not included in the scanned package.
All 62 static findings are false positives caused by Markdown links, code formatting, repository metadata, or documented local connector usage. No prompt injection, credential exposure, data exfiltration, or malicious execution intent was found in the two reviewed files.
All 62 static findings are false positives caused by Markdown backticks, repository-relative links, homepage metadata, and bounded connector examples. The reviewed files contain no prompt injection, credential exfiltration, arbitrary command execution, or user-controlled path traversal. The skill requests consent before saving reports and treats imported data as untrusted.
Most static findings are false positives caused by Markdown links, code-style labels, and prompt examples. The remaining confirmed issues are optional connector instructions that execute local Python scripts and may use RESEND_API_KEY, which require explicit consent and credential safeguards.
2
Files scanned
141
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
The skill explicitly references RESEND_API_KEY for an optional connector, so an agent may use a secret from the environment. Even read-only ESP access can expose account metadata if mishandled.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
The skill instructs the agent to run a Python connector from CLAUDE_PLUGIN_ROOT and use a Resend account context. This is real external command execution touching ESP data and should require explicit user consent.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
The skill instructs the agent to run a local Python DNS-over-HTTPS connector with a user-provided domain. This is legitimate deliverability tooling, but it still executes external code and performs network lookups.
Most static hits are false positives from Markdown backticks, relative documentation links, repository URLs, and deliverability terminology. The optional Python connector commands and RESEND_API_KEY are real risk surfaces because they execute local scripts and handle credentials. No evidence of prompt injection, data exfiltration intent, or malicious business logic was found.
2
Files scanned
141
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
Line 52 requires RESEND_API_KEY for optional Resend automation. The file does not show exfiltration, but use of a live API secret by an external helper is a real credential-handling risk.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
Line 52 tells the agent to run a Python connector from ${CLAUDE_PLUGIN_ROOT} that uses RESEND_API_KEY. This is a real external-command and credential-handling surface, although the stated purpose is read-only ESP verification.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
Line 54 tells the agent to run a Python DNS-over-HTTPS connector with user-supplied domain and selector arguments. The command supports legitimate DNS checks, but it still creates command-execution and input-validation risk.
Most static hits are false positives from Markdown backticks, relative documentation links, repository URLs, and deliverability terminology. The optional Python connector commands and RESEND_API_KEY are real risk surfaces because they execute local scripts and handle credentials. No evidence of prompt injection, data exfiltration intent, or malicious business logic was found.
2
Files scanned
141
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
Line 52 requires RESEND_API_KEY for optional Resend automation. The file does not show exfiltration, but use of a live API secret by an external helper is a real credential-handling risk.
**Zero-dependency ESP automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts
Line 52 tells the agent to run a Python connector from ${CLAUDE_PLUGIN_ROOT} that uses RESEND_API_KEY. This is a real external-command and credential-handling surface, although the stated purpose is read-only ESP verification.
**Zero-dependency S1 record pull (keyless, works for any ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scr
Line 54 tells the agent to run a Python DNS-over-HTTPS connector with user-supplied domain and selector arguments. The command supports legitimate DNS checks, but it still creates command-execution and input-validation risk.
All 62 static findings were adjudicated as false positives. The matches come from Markdown code fences, Markdown backticks, repository-relative links, public homepage metadata, and documentation for optional read-only email connectors. No prompt-injection attempt, credential exfiltration, malware behavior, or unsafe automatic command execution was found in the cited files.