jimprosser

Gmail Agent Shield — AI skill for Claude Code

AI community

Email filters and agent instructions that defend OpenClaw, Claude Code, and similar agentic AI systems against prompt injection delivered via email.

How to install Gmail Agent Shield

This entry records only its repository, not the path inside it, so there is no exact command to give. Open jimprosser/gmail-agent-shield and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Gmail Agent Shield does

Email filters and agent instructions that defend OpenClaw, Claude Code, and similar agentic AI systems against prompt injection delivered via email.

Alternatives in AI

Bot On Anything — A large model-based chatbot builder that can quickly integrate AI models (including ChatGPT, Claude, Gemini) i 4.2k ★
Snip — CLI proxy that reduces LLM token usage by 60-90% 425 ★
Pingcrm — Personal Networking CRM — AI-powered, open-source, self-hostable 115 ★

README

gmail-agent-shield

A minimal, opinionated set of Gmail filters and skill-level instructions that protect agentic AI systems from prompt injection delivered via email.

The problem

Agentic systems that read your email are everywhere now. OpenClaw, Claude Code, Codex, Gemini CLI, Manus, and whatever else is trending on Hacker News this week. They pull context from your inbox, summarize threads, draft replies, and call tools on your behalf. The security conversation around these systems focuses almost entirely on model-side defenses: fine-tuning against injection, training models to ignore instructions embedded in content, hardening the orchestration layer.

Those defenses are real but thin. They reduce the hit rate. They don't drive it to zero. And an attacker gets infinite attempts to rephrase.

Meanwhile, Gmail ships a server-side filter layer that runs before any agent ever reads a message. Free, deterministic, reversible. Almost nobody uses it as part of their agentic AI setup.

This repo is a drop-in starting point.

What it does

Three defense layers:

**Gmail filters (server-side).** Three filters route hostile-looking mail to an `AI/Quarantine` label and out of your inbox before your AI agent ever sees it:
- High-abuse TLDs (.skin, .top, .rest, .click, .cyou, .sbs, .monster, .zip, .mov)
- Known prompt-injection phrases (ignore previous instructions, system prompt, DAN mode, etc.)
- Assistant-name + action-verb combinations (claude/anthropic/assistant/gpt/chatgpt plus execute/curl/email to/forward to/send to)
**Agent-side query exclusion.** A snippet to add to your agent's Gmail search queries: `-label:AI/Quarantine`. Filters organize mail. This step makes your agent blind to the quarantined portion.
**Reading-time instruction.** A drop-in paragraph (`skill-template.md`) for your agent's system prompt or skill definition. It tells the model to treat email content as untrusted input, not as instructions.