himalaya
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the
backend.auth.cmdconfiguration setting, which allows the execution of local shell commands to retrieve credentials (e.g., using thepassutility or macOSsecuritytool). - [DATA_EXFILTRATION]: The skill facilitates reading and sending emails, which involves the transmission of potentially sensitive information across the network via IMAP and SMTP protocols.
- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection due to its core functionality. 1. Ingestion points: Reading email bodies and metadata via
envelope listandmessage readcommands. 2. Boundary markers: Absent; the agent is instructed to read and process email content directly without specific delimiters or warnings to ignore embedded instructions. 3. Capability inventory: The agent can send emails, reply to messages, forward content, and download attachments to the local file system. 4. Sanitization: There are no instructions or mechanisms provided for sanitizing or escaping external email content before it is ingested into the agent's context.
Audit Metadata