AI agents

Give the agent the skill

proton skill prints a skill in the Agent Skills format: a SKILL.md an agent reads before it acts. Save it in a directory named proton-cli, wherever your agent reads its skills from:

mkdir -p /path/to/skills/proton-cli
proton skill > /path/to/skills/proton-cli/SKILL.md

It is written from the installed build, so it names exactly the commands your proton has, and it tells the agent to print it again when the installed version is not the one that wrote the file.

An agent can read it as it runs instead. proton skill --body-only leaves the frontmatter out, which is what a skill of your own wants when all it says is to run this first:

---
name: proton-cli
description: (the description proton skill prints)
---

Before using proton, run `proton skill --body-only` and follow what it prints.

The skill describes the tool. What the agent may do with your account is yours to say, in its own instructions and in a confirmation policy.

Signing in stays yours: proton account login asks for the password and any second factor at a terminal, and no flag carries a password. The same holds for the commands that ask for the password again.

Fence what it may do

A confirmation policy is what says an agent may read your mail but never delete any:

export PROTON_CONFIRM='deletions=deny'

A permanent removal then exits 6 and touches nothing. --yes does not answer a deny, so the --yes the agent needs for the trashing it is meant to do cannot quietly authorise more.

This turns off proton api as well, reads included. A raw request can be anything, so it counts as a deletion whichever method it carries.

=deny is the part that fences. A class written without it only makes the command ask first, and --yes answers that in advance.

# read-only: nothing changes, at all
export PROTON_CONFIRM='mutations=deny'

# read-only, except that it may send
export PROTON_CONFIRM='mutations=deny, mail messages send:default'

The full syntax is in Writing a policy.

Give it a profile of its own if you want a way to cut it off:

proton account login --profile agent
PROTON_PROFILE=agent PROTON_CONFIRM='deletions=deny' your-agent
proton account logout --profile agent