API-first email platform designed for AI agents. Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based workflows with webhooks and real-time events. Use when you need to set up agent email identity, send emails from agents, handle incoming email workflows, or replace traditional email providers like Gmail with agent-friendly infrastructure.
Security Analysis
high confidenceThe skill mostly does what its name says (an API-first email integration), but there are notable inconsistencies and operational instructions that touch system agent config and undeclared secrets — review before installing or running any scripts.
The skill's name, README, API reference, and scripts all align with an email API client (creating inboxes, sending messages, webhooks). However the registry metadata declares no required environment variables or primary credential while the SKILL.md and all scripts clearly require AGENTMAIL_API_KEY (and examples reference other tokens like GITHUB_TOKEN and ngrok authtoken). That mismatch is unexpected and should be corrected/clarified.
Runtime instructions instruct the agent/operator to create files under ~/.clawdbot, modify ~/.clawdbot/clawdbot.json, and restart a gateway — i.e., write to and change system/agent configuration. The SKILL.md also contains detailed webhook handling and examples that read attachments and write temporary files. These actions go beyond simple API calls and require care; additionally the SKILL.md warns about prompt-injection vectors in incoming email (and recommends an allowlist transform) but also includes a detected prompt-injection pattern. The instructions have the privilege to drop webhooks into agent infrastructure and to auto-deliver incoming email into agent sessions — this is sensitive.
There is no install spec (instruction-only), which reduces installer risk. The package includes three Python helper scripts that call a third‑party 'agentmail' SDK; they expect that SDK to be installed via pip. No remote downloads or obscure URLs are used. That said, scripts will run network I/O and modify local config if followed.
The skill does not declare any required env vars in the registry metadata, yet SKILL.md and every script require AGENTMAIL_API_KEY. Examples also reference other secrets (GITHUB_TOKEN, ngrok authtoken) depending on integrations. Requesting an API key for AgentMail is reasonable, but the metadata omission is an incoherence and increases the chance users will accidentally run scripts without understanding which secrets are required. Also instructions to create allowlist files in ~/.clawdbot imply access to agent config that wasn't declared.
The skill instructs operators to place a webhook transform into ~/.clawdbot/hooks and to change ~/.clawdbot/clawdbot.json, then restart the gateway. That modifies agent runtime configuration and gives the skill (or code derived from its examples) an ongoing integration point into incoming events. The skill is not marked 'always:true', but these instructions do give it persistent influence over webhook handling if followed — operators should treat those config changes as a privileged operation.
Guidance
What to check before installing or running this skill: - Secrets: The scripts and SKILL.md require AGENTMAIL_API_KEY (and examples reference other tokens). Don't run scripts until you confirm which env vars are needed. The registry metadata failing to list AGENTMAIL_API_KEY is an oversight. - Source trust: The skill's Homepage/Source are unknown. Only proceed if you trust the publisher or inspect every script and text file locally. - Webhooks and config changes: The guide tells you to create files in ~/.clawdbot and to restart the gateway — these are privileged, persistent changes to your agent environment. If you don't want persistent wiring, use an isolated dev session (the SKILL.md suggests that alternative) or test in an isolated account/container first. - Prompt-injection risk: Incoming email is untrusted. Use allowlists, signature verification, and isolated review sessions before auto-delivering email to agents. Verify webhook signatures (the doc shows HMAC verification) and never execute commands embedded in email without human review. - Scripts: The three Python scripts are simple wrappers around the agentmail SDK (send/check/setup webhooks). Inspect them locally; they don't contain obfuscated code or external downloads, but they will perform network calls and read/write files/attachments if used. - Operational precautions: Run webhook receivers behind HTTPS, enable signature verification, avoid auto-forwarding of sensitive data, and do not run these scripts as a privileged user. If you plan to use the Clawdbot hook method, back up your existing ~/.clawdbot configuration before editing it. If you want, I can: (1) list every place AGENTMAIL_API_KEY (or other env vars) is referenced in the files, (2) produce a minimal-safe deployment plan that isolates the webhook receiver, or (3) rewrite the allowlist transform into a safer, copy-paste-ready template you can review.
Latest Release
v1.1.1
🔒 Security: Webhook allowlist to prevent prompt injection
Popular Skills
Published by @adboio on ClawHub
