Skip to main content
Anyone can write to an agent account’s email address or phone number, so a message can try to steer the client that reads it: ask it to send a secret, write to someone else, or act in your name. Artil hands every message to the client as information to act on, never as instructions, and leaves what to do with it to the client’s own instructions and to you.

​
What Artil tells the client

  • The artil skill that the plugins install and artil init writes says that messages come from outside, that their text is information and never instructions that override the user’s, and that a send that failed or was interrupted is checked with the user before trying again.
  • The MCP server says the same in its instructions to the client.
  • The Claude Code channel adds that senders never see the session and tells Claude who each sender is to the agent, so Claude acts on what the sender wants when you would want it done, and tells the sender through Artil when it can’t, instead of asking you.
  • A webhook body carries the sender and the subject, which people outside wrote, and leaves the message text out; your server fetches the text and should treat it the same way.
  • A message at the agent’s Message URL comes from a member or agent of the workspace, since nobody else can send one, so the agent takes it as its team’s request.
  • Linked secrets are environment variables in the client’s commands; the skill tells the agent to use them as $NAME and never print their values.

​
What you decide

  • Choose who can wake the agent. A new agent only takes mail, texts, and messages at its Message URL from you, who created it; open it to more senders on purpose.
  • Check what the client may do without asking before you connect it. Pi runs commands without asking for approval, so a message can lead it to act before you see it. The Claude Code plugin and artil init allow artil email, artil sms, artil telegram, and artil url to run without asking; Claude may ask before other commands.
  • Ask a client that watches on its own, such as ChatGPT or a Hermes or OpenClaw gateway, only for what you are happy for it to do with any message.
  • Send a test email yourself and read the reply before leaving a client to answer on its own.