Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
Bashtool to executehimalayaCLI commands for listing, reading, and sending emails. It correctly provides instructions for checking tool installation and account configuration using standard package management (brew). - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by reading untrusted data from external sources.
- Ingestion points: Reading email content via
himalaya message read <ID>(referenced inSKILL.md). - Boundary markers: The instructions do not specify any delimiters or warnings to treat email content as untrusted data.
- Capability inventory: The agent has access to
Bash,Read, andWritetools, allowing it to execute further CLI commands or interact with the filesystem. - Sanitization: There is no sanitization or filtering of the email body content mentioned; the skill only suggests truncating long messages for display purposes.
Audit Metadata