agent-email-inbox

name	agent-email-inbox
description	Use when building any system where email content triggers actions — AI agent inboxes, automated support handlers, email-to-task pipelines, or any workflow processing untrusted inbound email. Always use this skill when the user wants to receive emails and act on them programmatically, even if they don't mention "agent" — the skill contains critical security patterns (sender allowlists, content filtering, sandboxed processing) that prevent untrusted email from controlling your system.
license	MIT
metadata	{"author":"resend","version":"3.0.4","homepage":"https://resend.com/agent-skills","source":"https://github.com/resend/resend-skills","openclaw":{"primaryEnv":"RESEND_API_KEY","requires":{"env":["RESEND_API_KEY"]},"envVars":[{"name":"RESEND_API_KEY","required":true,"description":"Resend API key for sending and receiving emails"},{"name":"RESEND_WEBHOOK_SECRET","required":false,"description":"Webhook signing secret for verifying inbound email event payloads"},{"name":"SECURITY_LEVEL","required":false,"description":"Security level for inbound email processing (strict, moderate, permissive)"},{"name":"ALLOWED_SENDERS","required":false,"description":"Comma-separated list of allowed sender email addresses"},{"name":"ALLOWED_DOMAINS","required":false,"description":"Comma-separated list of allowed sender domains"},{"name":"OWNER_EMAIL","required":false,"description":"Owner email address for forwarding or notifications"}],"links":{"repository":"https://github.com/resend/resend-skills","documentation":"https://resend.com/docs/agent-email-inbox-skill"}}}
inputs	[{"name":"RESEND_API_KEY","description":"Resend API key for sending and receiving emails. Get yours at https://resend.com/api-keys","required":true},{"name":"RESEND_WEBHOOK_SECRET","description":"Webhook signing secret for verifying inbound email event payloads. Returned as `signing_secret` in the response when you create a webhook via the API.","required":false}]
references	["security-levels.md","webhook-setup.md","advanced-patterns.md"]

AI Agent Email Inbox

Overview

This skill covers setting up a secure email inbox that allows your application or AI agent to receive and respond to emails, with content safety measures in place.

Core principle: An AI agent's inbox receives untrusted input. Security configuration is important to handle this safely.

Why Webhook-Based Receiving?

Resend uses webhooks for inbound email, meaning your agent is notified instantly when an email arrives. This is valuable for agents because:

• Real-time responsiveness — React to emails within seconds, not minutes
• No polling overhead — No cron jobs checking "any new mail?" repeatedly
• Event-driven architecture — Your agent only wakes up when there's actually something to process
• Lower API costs — No wasted calls checking empty inboxes

Architecture

Sender → Email → Resend (MX) → Webhook → Your Server → AI Agent
                                              ↓
                                    Security Validation
                                              ↓
                                    Process or Reject

SDK Version Requirements

This skill requires Resend SDK features for webhook verification (webhooks.verify()) and email receiving (emails.receiving.get()). Always install the latest SDK version. If the project already has a Resend SDK installed, check the version and upgrade if needed.

Language	Package	Min Version
Node.js	resend	>= 6.9.2
Python	resend	>= 2.21.0
Go	resend-go/v3	>= 3.1.0
Ruby	resend	>= 1.0.0
PHP	resend/resend-php	>= 1.1.0
Rust	resend-rs	>= 0.20.0
Java	resend-java	>= 4.11.0
.NET	Resend	>= 0.2.1

Install the npm package: (or the equivalent for your language). For full sending docs, install the skill.