Agent Email Inbox

What it does

When your agent uses it

• Setting up an email inbox for an AI agent (Moltbot
• Similar) - configuring inbound email
• Tunneling for local development
• Implementing security measures to prevent prompt injection attacks

Example prompts

• “/agent-email-inbox”

Requirements

• Python 3
• Node.js
• A credential in RESEND_API_KEY
• A credential in RESEND_WEBHOOK_SECRET

Workflow steps

2 steps, taken from the step headings in SKILL.md.

1. 1Set up tunneling to get a stable public URL
2. 2Choose your webhook path and NEVER change it

What it can do on your machine

Read from SKILL.md and the folder at commit d8fa0be. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • ngrok
  • cloudflared
  • npm
  • curl
  • brew
  • npx
  • vercel

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • a1b2c3d4.ngrok-free.app
  • api.resend.com
  • owasp.org
  • ngrok.com

  Also links to:

  • dns.email

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • RESEND_API_KEY
  • RESEND_WEBHOOK_SECRET

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Agent Email Inbox loads about 10k tokens when it runs. Until then it costs about 61 tokens; SKILL.md has 3,138 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~61

When it runs · the whole SKILL.md, loaded when a task matches

~10k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:86

  - Human creates `.env` file directly: `echo "RESEND_API_KEY=re_xxx" >> .env`

• WarningMentions a paste, webhook or tunnelling service often used to send data outSKILL.md:474

  ngrok http --domain=myagent.ngrok.io 3000

• WarningMentions a paste, webhook or tunnelling service often used to send data outSKILL.md:477

  generated URL (e.g., `https://a1b2c3d4.ngrok-free.app`). You'll register this with Resend shortly.

• NoteMentions a .env fileSKILL.md:646

  // Write it directly to .env, never log it

• NoteMentions a .env fileSKILL.md:647

  // fs.appendFileSync('.env', `\nRESEND_WEBHOOK_SECRET=${data.signing_secret}\n`);

• NoteMentions a .env fileSKILL.md:663

  # Write the signing secret directly to .env, never log it

• NoteMentions a .env fileSKILL.md:664

  # with open('.env', 'a') as f:

• WarningMentions a paste, webhook or tunnelling service often used to send data outSKILL.md:742

  every restart (e.g., `https://a1b2c3d4.ngrok-free.app`)

• WarningMentions a paste, webhook or tunnelling service often used to send data outSKILL.md:747

  across restarts (e.g., `https://myagent.ngrok.io`)

• WarningMentions a paste, webhook or tunnelling service often used to send data outSKILL.md:763

  ngrok http --domain=myagent.ngrok.io 3000

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 3,138 words (~10,258 tokens).

name

agent-email-inbox

Read the full SKILL.md on GitHub

Files

Just SKILL.md in .agents/skills/resend/agent-email-inbox of viclafouch/meme-studio.

Open the folder on GitHubat commit d8fa0be

Used in 2 other repositories

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in viclafouch/meme-studio, which our catalogue first saw on October 7, 2026.

• curvenote/curvenote.agents/skills/resend/agent-email-inbox
• growupanand/ConvoForm.agents/skills/resend/agent-email-inbox