The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the himalaya command-line interface to perform email operations such as listing envelopes, reading message bodies, and sending emails.
[EXTERNAL_DOWNLOADS]: The skill instructions provide a method to install the required himalaya binary using the Homebrew package manager.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it facilitates the ingestion of untrusted external content from email messages.
Ingestion points: Untrusted data enters the agent's context through the himalaya message read and himalaya envelope list commands in SKILL.md.
Boundary markers: The instructions lack specific delimiters or instructions to prevent the agent from interpreting and following commands embedded within the email text.
Capability inventory: The agent possesses capabilities that could be abused if compromised, including local file system access (for downloading attachments), shell command execution (via himalaya), and network operations (via Python's smtplib).
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the email content before it is processed by the agent.

himalaya