# Security Audit Report

**Score:** 83/100

**Skill:** resend-skills  
**Status:** Safe  
**Auditor:** christina-de-martinez  
**Files:** 41 files  
**Date:** 4/30/2026, 1:24:04 PM  
**Monitoring:** Continuously monitored by ClawSecure Watchtower

## Findings
- **Critical:** 0  
- **High:** 1  
- **Medium:** 1  
- **Low:** 1  
- **Info:** 0

**Source:** [Source Link](https://clawhub.ai/christina-de-martinez/resend-skills)  
**SHA-256:** 068148851252...

resend-skills is an Other skill for the OpenClaw ecosystem, created by christina-de-martinez. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 83/100, qualifying for ClawSecure Verified status. The audit identified 3 findings across the scan's three security layers.

## What does a score of 83 mean?
A security score of 83/100 places this skill in the Safe range. Skills scoring 80 or above qualify for ClawSecure Verified status, indicating they passed our comprehensive audit with minimal or no security concerns. ClawSecure calculates scores using a weighted deduction model: critical findings deduct 20 points, high-severity findings deduct 10, medium-severity 5, and low-severity 2. A perfect score of 100 means no findings were detected across all three audit layers.

## 3-Layer Audit Protocol

- **ClawSecure Proprietary Engine**  
   - **Findings:** 2 findings  
   - **Description:** Missing config.json - agent may not be properly configured, Potentially dangerous code pattern detected: curl.*\|.*sh  
   - **Severity:** CRITICAL

- **Advanced Static & Behavioral Analysis**  
   - **Findings:** 1 finding  
   - **Description:** Pipeline downloads data from the network and executes it: `curl -fsSL https://tailscale.com/install.sh | sh`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)  
   - **Severity:** WARNING

- **Supply Chain Security**  
   - **Findings:** 0 findings  
   - **Status:** PASS

## Findings Summary
### HIGH
- **Finding:** 1 finding    
   - **Description:** F-001 Potentially dangerous code pattern detected: curl.*\|.*sh  
   - **Location:** File: SKILL.md.

### MEDIUM
- **Finding:** 1 finding  
   - **Description:** F-001 Missing config.json - agent may not be properly configured  
   - **Location:** Detected by Proprietary. Category: config.

### LOW
- **Finding:** 1 finding  
   - **Description:** F-001 Pipeline downloads data from the network and executes it:...  
   - **Location:** File: agent-email-inbox/SKILL.md:3.

## OWASP ASI Framework Coverage

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

## Security Recommendations for resend-skills
1. **Pin npm dependencies to exact versions:** Unpinned dependencies allow supply chain attacks. Use exact version numbers in package.json (e.g., `1.2.3` instead of `^1.2.3`).
2. **Add a config.json permissions manifest:** This file declares what permissions your OpenClaw skill needs. Without it, users have no visibility into what your skill can do before installing.
3. **Review shell execution permissions:** Validate that commands are constructed from trusted inputs only.

## Security Research Links
- [How to Verify Any OpenClaw Skill in 30 Seconds→](/content/blog/verify-agent-30-seconds/index.html)  
- [Securing the OpenClaw Ecosystem: Your Complete Guide→](/content/blog/securing-the-openclaw-ecosystem/index.html)

## Scanned on April 30, 2026.  
resend-skills is one of 2,890+ agents audited by ClawSecure.