The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes a recommended installation command in SKILL.md that fetches a shell script from a remote URL and pipes it directly into the shell (curl -sSL https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh | PREFIX=~/.local sh). This pattern provides no opportunity for content verification before execution, allowing for potential code injection if the source or transmission is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external sources, which creates a surface for indirect prompt injection.
Ingestion points: Reading emails via himalaya message read and listing envelopes via himalaya envelope list (documented in SKILL.md).
Boundary markers: The instructions do not define boundary markers or clear delimiters to separate email content from agent instructions.
Capability inventory: The skill has capabilities to send emails (himalaya template send), move/copy/delete messages, and manage attachments, which could be abused if the agent follows instructions hidden within a processed email.
Sanitization: There is no evidence of sanitization or filtering of email content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill documentation in references/configuration.md highlights a feature where arbitrary shell commands can be configured to retrieve passwords (backend.auth.cmd). While this is a native feature of the Himalaya CLI, it represents a sensitive capability that could be targeted for abuse.

himalaya