himalaya
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Himalaya CLI using a shell script from its official GitHub repository:
curl -sSL https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh | PREFIX=~/.local sh. This is a standard installation method for the tool. - [COMMAND_EXECUTION]: The skill documents numerous commands for the
himalayaCLI to manage emails, including reading, searching, and sending messages. It also includes examples of piping data (e.g.,cat << EOF | himalaya template send) and using shell utilities likesedto modify email templates. These are consistent with the skill's primary purpose of providing a terminal-based email workflow. - [CREDENTIALS_UNSAFE]: The documentation references sensitive file paths such as
~/.config/himalaya/config.tomland~/.ssh/(implicitly viapass), and provides example configuration templates. However, it correctly advises users to store passwords securely using tools likepassor a keyring (e.g.,backend.auth.cmd = "pass show email/imap") rather than hardcoding them, which follows security best practices.
Audit Metadata