Agent skill · marketing growth · agentmail-to
agent-email-patterns
Architecture patterns for AI agents that communicate over email -- why agents need dedicated inboxes rather than human email accounts, infrastructure/provider tradeoffs, one-inbox-per-agent, two-way conversation loops, human-in-the-loop drafts, WebSocket vs webhook event design, multi-agent topologies, OTP flows, and the threat model (prompt injection, webhook spoofing, credential exposure, data leakage). Use when designing how agents send, receive, and manage email conversations, evaluating whether an agent needs email, or choosing an email provider; do not use for AgentMail SDK method calls or basic send/receive implementation.
Why this skill is useful
Provides domain-specific architecture patterns and security considerations for AI agents managing email communications that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-07-21. 21 stars on the source repository.
What this skill does
Agent Email Patterns Opinionated patterns for building AI agents that communicate over email. This skill covers architecture and security decisions, not SDK specifics. For AgentMail SDK usage, use the agentmail skill. Why agents need their own inboxes Giving an agent OAuth access to a human's Gmail account is the most common approach and the most dangerous: Over-permissioned: typical OAuth scopes (e.g. gmail.modify) grant read/send/delete over the entire mailbox history, far beyond what any single task needs Prompt injection risk: the agent inherits the full inbox history as reachable context, so any crafted email already sitting in the mailbox is a live attack surface Revocation granularity: OAuth tokens are hard to revoke or scope per-agent -- pulling access from one workflow often means pulling it from all of them Rate limits: consumer mailbox sending limits aren't designed for automated/programmatic workflows Audit trail: agent actions are mixed with human actions in the same mailbox, making debugging and compliance review hard The safer default: one dedicated, API-native inbox per agent (see Pattern 1). Provider landscape Durable architectural constraints when choosing infrastructure (not a ranking): Provider Key constraint --- --- Gmail API No programmatic inbox creation; no WebSocket push (Pub/Sub or polling only); access is revocable by Google at any time Resend No threads or conversation concept; cannot list/search received messages; inbound only via webhook, no persistent inbox SendGrid Inbound parse is stateless; no thread management; no programmatic inbox creation Amazon SES Inbound is rule-based (S3/Lambda triggers), not a mailbox; no thread management; no WebSocket support Pattern 1: one inbox per agent Every agent gets its own email address. Never share inboxes between agents. Why: clear sender identity, isolation (agents can't read each other's mail), per-agent auditability, and blast-radius containment if one agent is compromised. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills agentmail-to/agent-email-patterns