Commune — Email for Agents
Commune provides agents with a dedicated email inbox and a REST API for seamless email management and automation.
Install this skill
Security score
The Commune — Email for Agents skill was audited on Jun 8, 2026 and we found 167 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 74 | curl -s -X POST https://api.commune.email/v1/inboxes \ |
Curl to non-GitHub URL
| 84 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
Curl to non-GitHub URL
| 95 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_your_inbox_id&limit=20" \ |
Curl to non-GitHub URL
| 105 | curl -s https://api.commune.email/v1/domains \ |
Curl to non-GitHub URL
| 111 | curl -s -X POST https://api.commune.email/v1/domains \ |
Curl to non-GitHub URL
| 120 | curl -s https://api.commune.email/v1/domains/d_abc123/records \ |
Curl to non-GitHub URL
| 127 | curl -s -X POST https://api.commune.email/v1/domains/d_abc123/verify \ |
Curl to non-GitHub URL
| 133 | curl -s https://api.commune.email/v1/domains/d_abc123 \ |
Curl to non-GitHub URL
| 144 | curl -s -X POST https://api.commune.email/v1/inboxes \ |
Curl to non-GitHub URL
| 160 | curl -s -X POST https://api.commune.email/v1/domains/d_abc123/inboxes \ |
Curl to non-GitHub URL
| 169 | curl -s https://api.commune.email/v1/inboxes \ |
Curl to non-GitHub URL
| 175 | curl -s "https://api.commune.email/v1/domains/d_abc123/inboxes" \ |
Curl to non-GitHub URL
| 181 | curl -s https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123 \ |
Curl to non-GitHub URL
| 187 | curl -s -X PUT https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123 \ |
Curl to non-GitHub URL
| 200 | curl -s -X DELETE https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123 \ |
Curl to non-GitHub URL
| 244 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_abc123&limit=20" \ |
Curl to non-GitHub URL
| 248 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_abc123&order=asc&limit=50" \ |
Curl to non-GitHub URL
| 252 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_abc123&cursor=eyJsYXN0S2V5Ijo..." \ |
Curl to non-GitHub URL
| 260 | curl -s "https://api.commune.email/v1/threads/conv_abc123/messages?order=asc" \ |
Curl to non-GitHub URL
| 268 | curl -s https://api.commune.email/v1/threads/conv_abc123/metadata \ |
Curl to non-GitHub URL
| 276 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/status \ |
Curl to non-GitHub URL
| 284 | curl -s -X POST https://api.commune.email/v1/threads/conv_abc123/tags \ |
Curl to non-GitHub URL
| 292 | curl -s -X DELETE https://api.commune.email/v1/threads/conv_abc123/tags \ |
Curl to non-GitHub URL
| 301 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/assign \ |
Curl to non-GitHub URL
| 307 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/assign \ |
Curl to non-GitHub URL
| 319 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
Curl to non-GitHub URL
| 332 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
Curl to non-GitHub URL
| 347 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
Curl to non-GitHub URL
| 361 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
Curl to non-GitHub URL
| 382 | curl -s "https://api.commune.email/v1/messages?inbox_id=i_abc123&limit=50&order=desc" \ |
Curl to non-GitHub URL
| 386 | curl -s "https://api.commune.email/v1/[email protected]&limit=20" \ |
Curl to non-GitHub URL
| 390 | curl -s "https://api.commune.email/v1/messages?inbox_id=i_abc123&after=2025-01-01T00:00:00Z&before=2025-02-01T00:00:00Z" \ |
Curl to non-GitHub URL
| 402 | curl -s "https://api.commune.email/v1/search/threads?q=customer+unhappy+with+shipping&inbox_id=i_abc123" \ |
Curl to non-GitHub URL
| 406 | curl -s "https://api.commune.email/v1/search/threads?q=refund+request&domain_id=d_abc123&limit=10" \ |
Curl to non-GitHub URL
| 410 | curl -s "https://api.commune.email/v1/search/threads?q=partnership+proposal&inbox_id=i_abc123" \ |
Curl to non-GitHub URL
| 427 | curl -s -X POST https://api.commune.email/v1/attachments/upload \ |
Curl to non-GitHub URL
| 438 | curl -s https://api.commune.email/v1/attachments/att_abc123 \ |
Curl to non-GitHub URL
| 444 | curl -s "https://api.commune.email/v1/attachments/att_abc123/url?expires_in=3600" \ |
Curl to non-GitHub URL
| 456 | curl -s "https://api.commune.email/v1/delivery/metrics?inbox_id=i_abc123&period=7d" \ |
Curl to non-GitHub URL
| 460 | curl -s "https://api.commune.email/v1/delivery/metrics?inbox_id=i_abc123&period=30d" \ |
Curl to non-GitHub URL
| 464 | curl -s "https://api.commune.email/v1/delivery/metrics?inbox_id=i_abc123&days=14" \ |
Curl to non-GitHub URL
| 473 | curl -s "https://api.commune.email/v1/delivery/events?inbox_id=i_abc123&limit=50" \ |
Curl to non-GitHub URL
| 477 | curl -s "https://api.commune.email/v1/delivery/events?inbox_id=i_abc123&event_type=bounced" \ |
Curl to non-GitHub URL
| 481 | curl -s "https://api.commune.email/v1/delivery/events?message_id=msg_abc123" \ |
Curl to non-GitHub URL
| 487 | curl -s "https://api.commune.email/v1/delivery/suppressions?inbox_id=i_abc123" \ |
Curl to non-GitHub URL
| 509 | curl -s "https://api.commune.email/v1/webhooks/deliveries?inbox_id=i_abc123&limit=50" \ |
Curl to non-GitHub URL
| 513 | curl -s "https://api.commune.email/v1/webhooks/deliveries?status=failed" \ |
Curl to non-GitHub URL
| 519 | curl -s https://api.commune.email/v1/webhooks/deliveries/wdel_abc123 \ |
Curl to non-GitHub URL
| 526 | curl -s -X POST https://api.commune.email/v1/webhooks/deliveries/wdel_abc123/retry \ |
Curl to non-GitHub URL
| 532 | curl -s https://api.commune.email/v1/webhooks/health \ |
Curl to non-GitHub URL
| 542 | curl -s -X POST "https://api.commune.email/v1/dmarc/reports?domain_id=d_abc123" \ |
Curl to non-GitHub URL
| 551 | curl -s "https://api.commune.email/v1/dmarc/reports?domain=mycompany.com&limit=50" \ |
Curl to non-GitHub URL
| 557 | curl -s "https://api.commune.email/v1/dmarc/summary?domain=mycompany.com&days=30" \ |
Curl to non-GitHub URL
| 567 | curl -s https://api.commune.email/v1/agent/org \ |
Curl to non-GitHub URL
| 573 | curl -s -X PATCH https://api.commune.email/v1/agent/org \ |
Curl to non-GitHub URL
| 581 | curl -s https://api.commune.email/v1/agent/api-keys \ |
Curl to non-GitHub URL
| 587 | curl -s -X POST https://api.commune.email/v1/agent/api-keys \ |
Curl to non-GitHub URL
| 599 | curl -s -X POST https://api.commune.email/v1/agent/api-keys/key_abc123/rotate \ |
Curl to non-GitHub URL
| 605 | curl -s -X DELETE https://api.commune.email/v1/agent/api-keys/key_abc123 \ |
Curl to non-GitHub URL
| 629 | curl -s -X POST https://api.commune.email/v1/auth/agent-register \ |
Curl to non-GitHub URL
| 672 | curl -s -X POST https://api.commune.email/v1/data/deletion-request \ |
Curl to non-GitHub URL
| 683 | curl -s -X POST https://api.commune.email/v1/data/deletion-request/req_abc123/confirm \ |
Curl to non-GitHub URL
| 691 | curl -s https://api.commune.email/v1/data/deletion-request/req_abc123 \ |
Curl to non-GitHub URL
| 703 | curl -s "https://api.commune.email/v1/search/threads?q=John+Smith+Acme+Corp&inbox_id=i_abc123" \ |
Curl to non-GitHub URL
| 707 | curl -s "https://api.commune.email/v1/threads/conv_abc123/messages?order=asc" \ |
Curl to non-GitHub URL
| 711 | curl -s -X POST https://api.commune.email/v1/threads/conv_abc123/tags \ |
Curl to non-GitHub URL
| 716 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/status \ |
Curl to non-GitHub URL
| 721 | curl -s "https://api.commune.email/v1/search/threads?q=needs+reply&inbox_id=i_abc123" \ |
Webhook reference - potential data exfiltration
| 10 | | commune | Use commune when you want your own email address, need to send or receive email autonomously, search your inbox by meaning not just keywords, triage conversations with tags and status, use |
Webhook reference - potential data exfiltration
| 49 | **5. Webhook Push + HMAC Verification** |
Webhook reference - potential data exfiltration
| 150 | "webhook": { |
Webhook reference - potential data exfiltration
| 185 | ### Update Inbox (Webhook, Local Part, Status) |
Webhook reference - potential data exfiltration
| 191 | "webhook": { |
Webhook reference - potential data exfiltration
| 494 | ## Webhooks |
Webhook reference - potential data exfiltration
| 496 | ### ⚡ Webhook Payload Verification (HMAC-SHA256) |
Webhook reference - potential data exfiltration
| 497 | Every inbound webhook is signed. Always verify before processing: |
Webhook reference - potential data exfiltration
| 505 | Verify by computing `HMAC-SHA256(key=webhook_secret, message=timestamp + "." + raw_body_string)` and comparing to the `v1=` value. |
Webhook reference - potential data exfiltration
| 507 | ### List Webhook Deliveries |
Webhook reference - potential data exfiltration
| 509 | curl -s "https://api.commune.email/v1/webhooks/deliveries?inbox_id=i_abc123&limit=50" \ |
Webhook reference - potential data exfiltration
| 513 | curl -s "https://api.commune.email/v1/webhooks/deliveries?status=failed" \ |
Webhook reference - potential data exfiltration
| 519 | curl -s https://api.commune.email/v1/webhooks/deliveries/wdel_abc123 \ |
Webhook reference - potential data exfiltration
| 526 | curl -s -X POST https://api.commune.email/v1/webhooks/deliveries/wdel_abc123/retry \ |
Webhook reference - potential data exfiltration
| 532 | curl -s https://api.commune.email/v1/webhooks/health \ |
Webhook reference - potential data exfiltration
| 792 | | GET | /v1/webhooks/deliveries | messages:read | List webhook deliveries | |
Webhook reference - potential data exfiltration
| 793 | | GET | /v1/webhooks/deliveries/:id | messages:read | Full delivery detail | |
Webhook reference - potential data exfiltration
| 794 | | POST | /v1/webhooks/deliveries/:id/retry | messages:write | Retry dead delivery | |
Webhook reference - potential data exfiltration
| 795 | | GET | /v1/webhooks/health | messages:read | Per-endpoint health stats | |
Base64 decode operation
| 621 | pub = base64.b64encode(private_key.public_key().public_bytes_raw()).decode() |
Base64 decode operation
| 622 | priv = base64.b64encode(private_key.private_bytes_raw()).decode() |
Base64 decode operation
| 645 | priv_bytes = base64.b64decode("YOUR_PRIVATE_KEY") |
Base64 decode operation
| 648 | sig = base64.b64encode(private_key.sign(challenge.encode())).decode() |
External URL reference
| 19 | **Base URL:** `https://api.commune.email` |
External URL reference
| 26 | Get your key at [commune.email](https://commune.email) → API Keys. The key prefix is `comm_`. |
External URL reference
| 74 | curl -s -X POST https://api.commune.email/v1/inboxes \ |
External URL reference
| 84 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
External URL reference
| 95 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_your_inbox_id&limit=20" \ |
External URL reference
| 105 | curl -s https://api.commune.email/v1/domains \ |
External URL reference
| 111 | curl -s -X POST https://api.commune.email/v1/domains \ |
External URL reference
| 120 | curl -s https://api.commune.email/v1/domains/d_abc123/records \ |
External URL reference
| 127 | curl -s -X POST https://api.commune.email/v1/domains/d_abc123/verify \ |
External URL reference
| 133 | curl -s https://api.commune.email/v1/domains/d_abc123 \ |
External URL reference
| 144 | curl -s -X POST https://api.commune.email/v1/inboxes \ |
External URL reference
| 151 | "endpoint": "https://your-server.com/email-hook", |
External URL reference
| 160 | curl -s -X POST https://api.commune.email/v1/domains/d_abc123/inboxes \ |
External URL reference
| 169 | curl -s https://api.commune.email/v1/inboxes \ |
External URL reference
| 175 | curl -s "https://api.commune.email/v1/domains/d_abc123/inboxes" \ |
External URL reference
| 181 | curl -s https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123 \ |
External URL reference
| 187 | curl -s -X PUT https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123 \ |
External URL reference
| 192 | "endpoint": "https://new-server.com/hook", |
External URL reference
| 200 | curl -s -X DELETE https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123 \ |
External URL reference
| 208 | https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123/extraction-schema \ |
External URL reference
| 232 | https://api.commune.email/v1/domains/d_abc123/inboxes/i_abc123/extraction-schema \ |
External URL reference
| 244 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_abc123&limit=20" \ |
External URL reference
| 248 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_abc123&order=asc&limit=50" \ |
External URL reference
| 252 | curl -s "https://api.commune.email/v1/threads?inbox_id=i_abc123&cursor=eyJsYXN0S2V5Ijo..." \ |
External URL reference
| 260 | curl -s "https://api.commune.email/v1/threads/conv_abc123/messages?order=asc" \ |
External URL reference
| 268 | curl -s https://api.commune.email/v1/threads/conv_abc123/metadata \ |
External URL reference
| 276 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/status \ |
External URL reference
| 284 | curl -s -X POST https://api.commune.email/v1/threads/conv_abc123/tags \ |
External URL reference
| 292 | curl -s -X DELETE https://api.commune.email/v1/threads/conv_abc123/tags \ |
External URL reference
| 301 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/assign \ |
External URL reference
| 307 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/assign \ |
External URL reference
| 319 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
External URL reference
| 332 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
External URL reference
| 347 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
External URL reference
| 361 | curl -s -X POST https://api.commune.email/v1/messages/send \ |
External URL reference
| 382 | curl -s "https://api.commune.email/v1/messages?inbox_id=i_abc123&limit=50&order=desc" \ |
External URL reference
| 386 | curl -s "https://api.commune.email/v1/[email protected]&limit=20" \ |
External URL reference
| 390 | curl -s "https://api.commune.email/v1/messages?inbox_id=i_abc123&after=2025-01-01T00:00:00Z&before=2025-02-01T00:00:00Z" \ |
External URL reference
| 402 | curl -s "https://api.commune.email/v1/search/threads?q=customer+unhappy+with+shipping&inbox_id=i_abc123" \ |
External URL reference
| 406 | curl -s "https://api.commune.email/v1/search/threads?q=refund+request&domain_id=d_abc123&limit=10" \ |
External URL reference
| 410 | curl -s "https://api.commune.email/v1/search/threads?q=partnership+proposal&inbox_id=i_abc123" \ |
External URL reference
| 427 | curl -s -X POST https://api.commune.email/v1/attachments/upload \ |
External URL reference
| 438 | curl -s https://api.commune.email/v1/attachments/att_abc123 \ |
External URL reference
| 444 | curl -s "https://api.commune.email/v1/attachments/att_abc123/url?expires_in=3600" \ |
External URL reference
| 446 | # → { "data": { "url": "https://...", "expires_in": 3600, "filename": "invoice.pdf" } } |
External URL reference
| 456 | curl -s "https://api.commune.email/v1/delivery/metrics?inbox_id=i_abc123&period=7d" \ |
External URL reference
| 460 | curl -s "https://api.commune.email/v1/delivery/metrics?inbox_id=i_abc123&period=30d" \ |
External URL reference
| 464 | curl -s "https://api.commune.email/v1/delivery/metrics?inbox_id=i_abc123&days=14" \ |
External URL reference
| 473 | curl -s "https://api.commune.email/v1/delivery/events?inbox_id=i_abc123&limit=50" \ |
External URL reference
| 477 | curl -s "https://api.commune.email/v1/delivery/events?inbox_id=i_abc123&event_type=bounced" \ |
External URL reference
| 481 | curl -s "https://api.commune.email/v1/delivery/events?message_id=msg_abc123" \ |
External URL reference
| 487 | curl -s "https://api.commune.email/v1/delivery/suppressions?inbox_id=i_abc123" \ |
External URL reference
| 509 | curl -s "https://api.commune.email/v1/webhooks/deliveries?inbox_id=i_abc123&limit=50" \ |
External URL reference
| 513 | curl -s "https://api.commune.email/v1/webhooks/deliveries?status=failed" \ |
External URL reference
| 519 | curl -s https://api.commune.email/v1/webhooks/deliveries/wdel_abc123 \ |
External URL reference
| 526 | curl -s -X POST https://api.commune.email/v1/webhooks/deliveries/wdel_abc123/retry \ |
External URL reference
| 532 | curl -s https://api.commune.email/v1/webhooks/health \ |
External URL reference
| 542 | curl -s -X POST "https://api.commune.email/v1/dmarc/reports?domain_id=d_abc123" \ |
External URL reference
| 551 | curl -s "https://api.commune.email/v1/dmarc/reports?domain=mycompany.com&limit=50" \ |
External URL reference
| 557 | curl -s "https://api.commune.email/v1/dmarc/summary?domain=mycompany.com&days=30" \ |
External URL reference
| 567 | curl -s https://api.commune.email/v1/agent/org \ |
External URL reference
| 573 | curl -s -X PATCH https://api.commune.email/v1/agent/org \ |
External URL reference
| 581 | curl -s https://api.commune.email/v1/agent/api-keys \ |
External URL reference
| 587 | curl -s -X POST https://api.commune.email/v1/agent/api-keys \ |
External URL reference
| 599 | curl -s -X POST https://api.commune.email/v1/agent/api-keys/key_abc123/rotate \ |
External URL reference
| 605 | curl -s -X DELETE https://api.commune.email/v1/agent/api-keys/key_abc123 \ |
External URL reference
| 629 | curl -s -X POST https://api.commune.email/v1/auth/agent-register \ |
External URL reference
| 650 | r = requests.post("https://api.commune.email/v1/auth/agent-verify", json={ |
External URL reference
| 672 | curl -s -X POST https://api.commune.email/v1/data/deletion-request \ |
External URL reference
| 683 | curl -s -X POST https://api.commune.email/v1/data/deletion-request/req_abc123/confirm \ |
External URL reference
| 691 | curl -s https://api.commune.email/v1/data/deletion-request/req_abc123 \ |
External URL reference
| 703 | curl -s "https://api.commune.email/v1/search/threads?q=John+Smith+Acme+Corp&inbox_id=i_abc123" \ |
External URL reference
| 707 | curl -s "https://api.commune.email/v1/threads/conv_abc123/messages?order=asc" \ |
External URL reference
| 711 | curl -s -X POST https://api.commune.email/v1/threads/conv_abc123/tags \ |
External URL reference
| 716 | curl -s -X PUT https://api.commune.email/v1/threads/conv_abc123/status \ |
External URL reference
| 721 | curl -s "https://api.commune.email/v1/search/threads?q=needs+reply&inbox_id=i_abc123" \ |