The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data (emails) using commands such as himalaya message read and himalaya envelope list, creating a surface for indirect prompt injection attacks. An attacker could send an email containing malicious instructions intended to manipulate the agent's future actions.
Ingestion points: Email content is ingested into the agent context through himalaya message read, himalaya message export, and himalaya envelope list (file: SKILL.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat email body content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill possesses capabilities to delete emails (himalaya message delete), forward content (himalaya message forward), and send new messages (himalaya template send), which could be abused if the agent follows instructions found within a read email (file: SKILL.md).
Sanitization: No sanitization, filtering, or validation of the email content is performed before it is presented to the agent.

himalaya