himalaya
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the use of MML (MIME Meta Language) syntax for handling attachments within message bodies, which presents a security risk if the agent processes untrusted data.
- Ingestion points: Message bodies and templates are constructed based on user instructions or external data processed by the agent (found in SKILL.md under 'Attachments' and 'Templates').
- Boundary markers: The instructions do not include boundary markers or warnings to ignore MML tags embedded in untrusted content.
- Capability inventory: The skill utilizes the
himalayaCLI to read, compose, and send emails, including the capability to attach arbitrary local files via the<#part filename=...>syntax. - Sanitization: There is no mention of sanitizing or validating file paths before they are included in MML parts. A malicious prompt or external data source could trick the agent into including sensitive files (such as
~/.ssh/id_rsaor.envfiles) as attachments in outgoing emails.
Audit Metadata