senderkit-integration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited senderkit-integration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this open-source skill to add SenderKit to an application with minimal disruption. SenderKit sends transactional email, SMS, push, and web-push directly, and can also route through existing providers (Resend, SendGrid, Postmark, Mailgun, SES, SMTP, Twilio, FCM, APNs, Expo) so the app is not locked into one vendor. The reusable source lives at https://github.com/senderkit/senderkit-skills in the skills/senderkit-integration/ directory, while the skill name remains senderkit-integration. Favor codebase-aware integration over generic snippets: detect the stack, find existing notification flows, preserve behavior, and add SenderKit behind a small local wrapper.
This skill writes SenderKit into the application's code. To operate SenderKit at runtime through MCP tool calls (send a test message, check delivery status, manage templates) without changing code, use the senderkit-mcp-messaging-operations skill instead.
references/language-detection.md when the stack or provider is not obvious.https://www.senderkit.com/openapi.yaml before writing API request shapes.python3 scripts/fetch_openapi.py --compare public/openapi.yaml.public/openapi.yaml when present and clearly note that the live contract was not checked.@senderkit/sdk (import { SenderKit } from "@senderkit/sdk"). Confirm the current version on npm before installing; if docs and package metadata disagree, fall back to the REST API.references/examples.md for ready-to-adapt REST snippets.SENDERKIT_API_KEY in environment/config only. Never hardcode keys.senderkitClient, notifications, or mailProvider instead of scattering HTTP calls.Idempotency-Key for every send that can be retried. Prefer stable keys like <event>/<entity-id>/<recipient-id>.references/migration-playbook.md before replacing Resend, SendGrid, Postmark, Mailgun, SES, SMTP, Twilio, APNs, FCM, Expo, or another provider.references/api-reference.md for current OpenAPI usage and request-shape lookup.references/verification.md before finalizing.senderkit-email-deliverability skill so messages reach the inbox instead of spam.https://github.com/senderkit/senderkit-skillsskills/senderkit-integration/https://www.senderkit.com/openapi.yamlWhen reused from GitHub, keep the complete skills/senderkit-integration/ directory together:
skills/senderkit-integration/
|-- AGENTS.md
|-- README.md
|-- SKILL.md
|-- agents/
| `-- openai.yaml
|-- llms.txt
|-- references/
| |-- api-reference.md
| |-- examples.md
| |-- language-detection.md
| |-- migration-playbook.md
| |-- sources.md
| `-- verification.md
`-- scripts/
`-- fetch_openapi.pyreferences/language-detection.md - Detect project language, framework, package manager, and existing providers.references/api-reference.md - How to fetch/read the current OpenAPI contract and apply it safely.references/examples.md - Ready-to-adapt REST snippets (curl, TypeScript, Python, PHP, Ruby, Go) for a template send and a status read.references/migration-playbook.md - Provider migration strategy and mapping from common email/SMS/push systems.references/verification.md - Test, rollout, and production-safety checklist.references/sources.md - Source notes used to build this skill.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.