AgentMail
v1.1.1API-first email platform designed for AI agents. Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based workflows with webhooks and real-time events. Use when you need to set up agent email identity, send emails from agents, handle incoming email workflows, or replace traditional email providers like Gmail with agent-friendly infrastructure.
⭐ 52· 25.8k·290 current·312 all-time
by@adboio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name, README, API reference, and scripts all align with an email API client (creating inboxes, sending messages, webhooks). However the registry metadata declares no required environment variables or primary credential while the SKILL.md and all scripts clearly require AGENTMAIL_API_KEY (and examples reference other tokens like GITHUB_TOKEN and ngrok authtoken). That mismatch is unexpected and should be corrected/clarified.
Instruction Scope
Runtime instructions instruct the agent/operator to create files under ~/.clawdbot, modify ~/.clawdbot/clawdbot.json, and restart a gateway — i.e., write to and change system/agent configuration. The SKILL.md also contains detailed webhook handling and examples that read attachments and write temporary files. These actions go beyond simple API calls and require care; additionally the SKILL.md warns about prompt-injection vectors in incoming email (and recommends an allowlist transform) but also includes a detected prompt-injection pattern. The instructions have the privilege to drop webhooks into agent infrastructure and to auto-deliver incoming email into agent sessions — this is sensitive.
Install Mechanism
There is no install spec (instruction-only), which reduces installer risk. The package includes three Python helper scripts that call a third‑party 'agentmail' SDK; they expect that SDK to be installed via pip. No remote downloads or obscure URLs are used. That said, scripts will run network I/O and modify local config if followed.
Credentials
The skill does not declare any required env vars in the registry metadata, yet SKILL.md and every script require AGENTMAIL_API_KEY. Examples also reference other secrets (GITHUB_TOKEN, ngrok authtoken) depending on integrations. Requesting an API key for AgentMail is reasonable, but the metadata omission is an incoherence and increases the chance users will accidentally run scripts without understanding which secrets are required. Also instructions to create allowlist files in ~/.clawdbot imply access to agent config that wasn't declared.
Persistence & Privilege
The skill instructs operators to place a webhook transform into ~/.clawdbot/hooks and to change ~/.clawdbot/clawdbot.json, then restart the gateway. That modifies agent runtime configuration and gives the skill (or code derived from its examples) an ongoing integration point into incoming events. The skill is not marked 'always:true', but these instructions do give it persistent influence over webhook handling if followed — operators should treat those config changes as a privileged operation.
Scan Findings in Context
[ignore-previous-instructions] unexpected: A prompt-injection pattern was detected in SKILL.md. The README itself warns about prompt injection risk from incoming email (which is expected), but presence of a pattern like 'ignore-previous-instructions' in a skill's runtime instructions is suspicious because it could be used (or copied into transforms) to try to subvert agent safeguards. Treat any code/templates that accept email content as untrusted input and validate/normalize before use.
What to consider before installing
What to check before installing or running this skill:
- Secrets: The scripts and SKILL.md require AGENTMAIL_API_KEY (and examples reference other tokens). Don't run scripts until you confirm which env vars are needed. The registry metadata failing to list AGENTMAIL_API_KEY is an oversight.
- Source trust: The skill's Homepage/Source are unknown. Only proceed if you trust the publisher or inspect every script and text file locally.
- Webhooks and config changes: The guide tells you to create files in ~/.clawdbot and to restart the gateway — these are privileged, persistent changes to your agent environment. If you don't want persistent wiring, use an isolated dev session (the SKILL.md suggests that alternative) or test in an isolated account/container first.
- Prompt-injection risk: Incoming email is untrusted. Use allowlists, signature verification, and isolated review sessions before auto-delivering email to agents. Verify webhook signatures (the doc shows HMAC verification) and never execute commands embedded in email without human review.
- Scripts: The three Python scripts are simple wrappers around the agentmail SDK (send/check/setup webhooks). Inspect them locally; they don't contain obfuscated code or external downloads, but they will perform network calls and read/write files/attachments if used.
- Operational precautions: Run webhook receivers behind HTTPS, enable signature verification, avoid auto-forwarding of sensitive data, and do not run these scripts as a privileged user. If you plan to use the Clawdbot hook method, back up your existing ~/.clawdbot configuration before editing it.
If you want, I can: (1) list every place AGENTMAIL_API_KEY (or other env vars) is referenced in the files, (2) produce a minimal-safe deployment plan that isolates the webhook receiver, or (3) rewrite the allowlist transform into a safer, copy-paste-ready template you can review.Like a lobster shell, security has layers — review code before you run it.
latestvk9799ry9q15vaezq3kn6d9c90x7zy0f6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.