The example creates an unauthenticated email-sending endpoint
Source references: 4The example declares the sending function public but performs no caller authentication, order-ownership check, or verification that the recipient belongs to the caller. The caller selects the recipient and controls the username and order reference inserted into the subject and body.
If copied into an application, anyone able to call the canister could send email to arbitrary addresses under the application's identity, enabling spam, phishing, or harassment while consuming email quota and harming domain reputation. Because the API treats the body as HTML, unescaped dynamic values could also insert deceptive markup.
The skill explicitly directs use of the email-sending function, while the example exposes a public wrapper whose caller supplies the recipient address, username, and order reference. No identity, order-ownership, or recipient-authorization check is visible. If deployed as shown, anyone able to call that endpoint could potentially send fabricated order confirmations to arbitrary addresses, creating spam, reputation, or cost risk. A user can ask the author for authentication, server-side order-to-recipient binding, rate limits, and removal of caller-controlled recipient/content fields.
public func sendServiceEmail( fromUsername : Text, recipients : [Text], subject : Text, htmlBody : Text, ) : async SendResult;};Show 3 other places
actor { public func sendOrderConfirmationEmail(recipientEmailAddress : Text, username : Text, orderReference : Text) : async () { let result = await EmailClient.sendServiceEmail( "no-reply", [recipientEmailAddress], "Order " # orderReference # " confirmed", "Hello " # username # ",\nYour order " # orderReference # " has been confirmed. Your items will ship tomorrow.", ); switch (result) {This skill adds support for sending service and transactional emails from the backend canister. Use `sendServiceEmail` for order confirmations, notifications, and similar one-off emails.- Use the sendServiceEmail function. - Each recipient is sent an individual email- It returns a SendResult which is #ok if the email is sent successfully otherwise #err(error) with the error text.