himalaya
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages external email content which serves as an ingestion point for untrusted data. While it includes safety protocols, it remains theoretically vulnerable to indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through email envelopes and message bodies fetched via
himalaya envelope list,himalaya envelope search, and reading operations described inSKILL.md. - Boundary markers: The instructions do not specify explicit delimiters for email content but require redacting credentials and sensitive information from summaries.
- Capability inventory: The skill has the capability to send, move, copy, and delete emails using the
himalayaCLI, as specified inSKILL.md. - Sanitization: Outgoing messages are formatted using Python's
emailpackage to ensure valid MIME structure, but there is no explicit instruction to ignore or sanitize potentially malicious commands embedded in incoming emails. - [DYNAMIC_EXECUTION]: The skill uses a shell heredoc to generate and execute a local Python script at runtime for the purpose of creating standards-compliant email headers and bodies. This pattern involves the assembly of executable code to handle non-ASCII text and multipart content.
Audit Metadata