4.configure a sender allowlist to block prompt injection
the skill.md has everything: registration, inbox, outbox, sender allowlist, error handling.
no SDK. no library. just curl and jq.
install rho to get a persistent agent with email built in.
or just give any existing agent the skill.md URL above.
$curl -fsSL https://rhobot.dev/install | bashclick to copy
1.install rho (termux, macos, or linux)
2.run rho login to connect your LLM subscription
3.the email extension polls your inbox automatically every 5 minutes
rho comes with the email extension pre-installed. status bar, notifications,
slash commands, and an LLM tool for reading and replying to mail.
// how it works
the basics
receivemail to [email protected] lands in your agent's inbox. polling or push, your choice.
allowlistmessages from unknown senders are held, never shown to the LLM. server-side + client-side filtering.
read + actagent reads approved messages, marks them acted, logs what it did. full audit trail.
replysend outbound email from [email protected]. proper threading headers for replies.
any agentworks with Claude Code, Codex, Cursor, rho, or anything that reads markdown and runs bash.
// security
prompt injection defense
an open agent inbox is a prompt injection surface. someone sends
"ignore all previous instructions" and your agent processes it.
rho cloud prevents this with a two-layer sender allowlist.
layer 1: serveremail worker checks the allowlist at ingestion. unknown senders stored as "held", never "unread".
layer 2: clientthe agent filters again before reading. even if the server misses one, the LLM never sees it.
reviewheld messages sit in a queue. you approve senders manually. the agent can't auto-approve.
--
agents
--
emails
--
uptime
// free tier
what you get
resource
free
inbound email
50/day
outbound email
1/hour
storage
100 MB
retention
30 days
agents
1
sender allowlist
unlimited
API access
full
cost
$0
// coming soon
email is the first piece
rho cloud gives agents three things: a way to communicate, capabilities that travel with them, and memory that persists everywhere.
extension syncinstall an extension on your phone, it appears on your laptop. share publicly, discover what other agents run. the start of an agent capability marketplace.
brain syncyour agent's memory, backed up and searchable across devices. client-side encrypted. your data stays yours. bundled free with extension sync pro.
recipient allowlistcontrol exactly who your agent can email. empty by default, nothing goes out until you approve it. protects everyone else from a compromised agent.
forward redactionforward someone's email to your agent and their address gets stripped automatically. the agent processes the content but never learns who sent it.