himalaya

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Himalaya CLI using a shell script from its official GitHub repository: curl -sSL https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh | PREFIX=~/.local sh. This is a standard installation method for the tool.
  • [COMMAND_EXECUTION]: The skill documents numerous commands for the himalaya CLI to manage emails, including reading, searching, and sending messages. It also includes examples of piping data (e.g., cat << EOF | himalaya template send) and using shell utilities like sed to modify email templates. These are consistent with the skill's primary purpose of providing a terminal-based email workflow.
  • [CREDENTIALS_UNSAFE]: The documentation references sensitive file paths such as ~/.config/himalaya/config.toml and ~/.ssh/ (implicitly via pass), and provides example configuration templates. However, it correctly advises users to store passwords securely using tools like pass or a keyring (e.g., backend.auth.cmd = "pass show email/imap") rather than hardcoding them, which follows security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 05:57 AM