agent-email-inbox
Use when building any system where email content triggers actions — AI agent inboxes, automated support handlers, email-to-task pipelines, or any workflow processing untrusted inbound email. Always use this skill when the user wants to receive emails and act on them programmatically, even if they don't mention "agent" — the skill contains critical security patterns (sender allowlists, content filtering, sandboxed processing) that prevent untrusted email from controlling your system.
89
87%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Quality
Discovery
89%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong description with excellent trigger coverage and completeness, clearly answering both what and when. Its main weakness is that it leans more heavily on describing when to use the skill than on listing specific concrete actions/capabilities it teaches. The security angle (sender allowlists, content filtering, sandboxed processing) adds valuable distinctiveness but is somewhat buried in parenthetical form.
Suggestions
Lead with concrete actions the skill teaches (e.g., 'Builds email ingestion pipelines with sender allowlists, content filtering, and sandboxed processing') before the 'Use when' guidance to improve specificity.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | The description names the domain (email-triggered systems) and lists several use cases (AI agent inboxes, automated support handlers, email-to-task pipelines), but it focuses more on when to use the skill than on concrete actions it performs. The security patterns mentioned (sender allowlists, content filtering, sandboxed processing) are parenthetical rather than presented as core capabilities. | 2 / 3 |
Completeness | The description explicitly answers both 'what' (building systems where email content triggers actions, with security patterns like sender allowlists, content filtering, sandboxed processing) and 'when' (multiple explicit trigger conditions including 'Use when building any system where email content triggers actions' and 'Always use this skill when the user wants to receive emails and act on them programmatically'). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms: 'email', 'inbound email', 'agent inboxes', 'automated support', 'email-to-task', 'workflow processing', 'receive emails', 'act on them programmatically'. These are terms users would naturally use when describing such systems. | 3 / 3 |
Distinctiveness Conflict Risk | The description carves out a very specific niche: programmatic processing of untrusted inbound email with security patterns. The combination of email processing + security + agent/automation context makes it clearly distinguishable from general email skills or general security skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
85%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, well-structured skill that provides actionable, security-first guidance for setting up an AI agent email inbox. Its main weakness is some verbosity — the 'Why Webhook-Based Receiving?' section and the full 8-language SDK version table could be trimmed without losing value. The workflow is clearly sequenced with good validation checkpoints, and progressive disclosure is well-executed with appropriate references to supporting files.
Suggestions
Remove or significantly condense the 'Why Webhook-Based Receiving?' section — Claude doesn't need to be convinced of webhook benefits, and this adds ~8 lines of unnecessary context.
Consider trimming the SDK version table to only the 2-3 most common languages (Node.js, Python, Go) and linking to a reference file for the full list.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill contains some unnecessary explanations (e.g., 'Why Webhook-Based Receiving?' section explains concepts Claude already understands, the architecture ASCII diagram is somewhat redundant). The SDK version table for 8 languages adds bulk. However, most content is relevant and actionable, so it's not severely verbose. | 2 / 3 |
Actionability | The skill provides fully executable code examples for Next.js App Router, Express, and sending replies. The webhook endpoint code is copy-paste ready with proper signature verification, raw body handling, and security integration. Specific commands, environment variables, and concrete configuration values are provided throughout. | 3 / 3 |
Workflow Clarity | The Quick Start section provides a clear numbered sequence. Security level selection is explicitly positioned before webhook setup. The skill includes validation checkpoints (verification checklist at the end, webhook signature verification in code, DNS propagation check). The common mistakes table serves as an error-recovery reference. The instruction to choose security level before writing webhook code creates a clear dependency chain. | 3 / 3 |
Progressive Disclosure | The skill provides a clear overview with well-signaled one-level-deep references to security-levels.md, webhook-setup.md, and advanced-patterns.md. Core content (Level 1 security, webhook endpoints) is inline while detailed implementations are appropriately delegated. Navigation is clear with descriptive link text. | 3 / 3 |
Total | 11 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- resend/resend-skills
- Commit
02d2e80
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.