Skills email-render-builder

📦

email-render-builder

Name: email-render-builder
Author: aaron-he-zhu

v19.0.0 Content revision r2 Safe 📁 Filesystem access⚙️ External commands🌐 Network access

Build responsive email HTML with render QA

Email HTML can fail across clients, dark mode, and image-off settings. This skill creates table-based builds and documents rendering, accessibility, and plain-text checks.

Supports: Claude Codex Code(CC)

🥉 77 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "email-render-builder" from https://skillstore.io/skills/aaron-he-zhu-email-render-builder.md and its manifest at https://skillstore.io/api/skills/aaron-he-zhu-email-render-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/aaron-he-zhu-email-render-builder.md Signed manifest GET /api/skills/aaron-he-zhu-email-render-builder/manifest Signed lockfile GET /api/skills/aaron-he-zhu-email-render-builder/lockfile

Test it

Using "email-render-builder". Approved promotion copy, CTA, destination URL, and brand colors.

Expected outcome:

Responsive table-based email build
Dark-mode and image-off fallback notes
Accessibility checklist and client-render matrix
Plain-text alternate with matching CTA and URL

Using "email-render-builder". Existing email HTML that fails in Outlook.

Expected outcome:

Outlook-specific layout findings
Recommended table and button corrections
Estimated rendering status for each requested client

Using "email-render-builder". Newsletter HTML without a plain-text version.

Expected outcome:

Plain-text alternate that preserves the core message
Parity check for the primary CTA and destination URL

Security Audit

Safe

v10 • 7/26/2026 Open versioned report

Most static matches are false positives caused by Markdown fences, relative documentation links, and email-client terminology. Two operational behaviors remain: an optional live render-test email command and a user-confirmed local result save; neither shows malicious intent, but both require confirmation and path validation.

Files scanned

192

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:82

Path traversal sequence

On user confirmation, save to `memory/email/email-render-builder/YYYY-MM-DD-<subject-slug>.md` — see

The skill instructs an agent to save a result under a memory path after user confirmation. The intended operation is bounded, but the subject-derived filename must be sanitized to prevent an unsafe path.

Medium

SKILL.md:54

Ruby/shell backtick execution

**Zero-dependency render-test send (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scrip

The documented Python command can deliver email when invoked with --live. It is limited to a verified sender and the user's own test inboxes, but it remains an external side effect that requires explicit confirmation.

Risk Factors

📁 Filesystem access (19)

references/email-render-specs.md:3 references/email-render-specs.md:56 SKILL.md:20 SKILL.md:40 SKILL.md:44 SKILL.md:48 SKILL.md:52 SKILL.md:54 SKILL.md:58 SKILL.md:68 SKILL.md:69 SKILL.md:82 SKILL.md:88 SKILL.md:89 SKILL.md:93 SKILL.md:94 SKILL.md:95 SKILL.md:96 SKILL.md:97

⚙️ External commands (16)

SKILL.md:18 SKILL.md:24-26 SKILL.md:26-28 SKILL.md:28-30 SKILL.md:30-32 SKILL.md:32-34 SKILL.md:34-38 SKILL.md:38-42 SKILL.md:42 SKILL.md:52 SKILL.md:54 SKILL.md:64 SKILL.md:66 SKILL.md:67-82 SKILL.md:82-87 SKILL.md:87-97

🌐 Network access (2)

SKILL.md:10 SKILL.md:13

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/aaron-he-zhu-email-render-builder/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/aaron-he-zhu-email-render-builder/security.svg)](https://skillstore.io/skills/aaron-he-zhu-email-render-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/aaron-he-zhu-email-render-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aaron-he-zhu-email-render-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/aaron-he-zhu-email-render-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

aaron-he-zhu. (2026). email-render-builder security audit report (audit version 10) [Author version 19.0.0]. Skillstore. https://skillstore.io/skills/aaron-he-zhu-email-render-builder/audits/10

BibTeX citation

@techreport{aaron-he-zhu-aaron-he-zhu-email-render-builder-2026,
  author = {aaron-he-zhu},
  title = {email-render-builder security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/aaron-he-zhu-email-render-builder/audits/10},
  note = {Author version 19.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "email-render-builder security audit report (audit version 10)"
version: "19.0.0"
type: report
authors:
  - name: "aaron-he-zhu"
date-released: "2026-07-26"
url: "https://skillstore.io/skills/aaron-he-zhu-email-render-builder/audits/10"
identifiers:
  - type: other
    value: "skillstore:aaron-he-zhu-email-render-builder:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Build a promotion email

Turn approved campaign copy into a responsive table-based email with a clear CTA and image-off fallbacks.

Repair an Outlook layout

Review supplied email HTML and identify table, dark-mode, or image fallback changes for Outlook and other target clients.

Prepare a newsletter handoff

Create a render matrix, accessibility checklist, and plain-text parity notes before ESP delivery.

Try These Prompts

Create a basic email build

Build responsive email HTML from this approved subject, preheader, body, CTA, and destination URL: [paste creative]. Use a single-column table layout.

Check client rendering

QA this email HTML for Gmail, Outlook desktop and web, Apple Mail, iOS, and Android. List dark-mode, image-off, and responsive risks as Estimated unless tested: [paste HTML].

Fix a rendering issue

This email breaks in Outlook and loses meaning when images are off. Revise the supplied HTML with table-safe structure, bulletproof CTAs, and fallbacks. Keep the approved copy unchanged: [paste HTML].

Prepare an audited handoff

Build and QA this newsletter from the approved creative. Return HTML, a client-render matrix, accessibility results, image-off notes, and a plain-text alternate with matching CTA and destination: [paste creative].

Best Practices

Provide approved copy, the destination URL, target clients, and brand constraints before requesting a build.
Treat untested client behavior as estimated and verify critical sends with user-owned seed inboxes.
Keep the plain-text message, CTA, and destination aligned with the HTML version.

Avoid

Do not use image-only offers or CTA buttons that disappear when images are blocked.
Do not present support-matrix expectations as measured rendering results.
Do not ask this skill to rewrite approved marketing copy or score campaign quality.