Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands including himalaya for email operations, osascript for triggering Apple Mail synchronization, and the security utility for managing credentials within the macOS Keychain.\n- [EXTERNAL_DOWNLOADS]: Recommends the installation of the himalaya CLI tool through standard and well-known package managers such as Homebrew and Cargo.\n- [DATA_EXFILTRATION]: Accesses sensitive system paths including the Apple Mail database (
/Library/Mail/V*/MailData/Envelope Index) and the himalaya configuration file (/.config/himalaya/config.toml). It also retrieves email passwords from the macOS Keychain using the security command.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from incoming emails which could contain malicious instructions.\n - Ingestion points: Reading email bodies via himalaya and querying the Apple Mail SQLite database.\n
- Boundary markers: None identified; the instructions do not specify any markers to separate email content from agent instructions.\n
- Capability inventory: The skill has the capability to execute shell commands, read sensitive local files, and communicate over the network via SMTP.\n
- Sanitization: No specific sanitization or escaping of email content is mentioned before the data is presented to the agent.
Audit Metadata