The Agent Skills Directory

[DATA_EXFILTRATION]: The skill requires access to ~/.config/himalaya/config.toml, a configuration file that contains sensitive metadata about email accounts, including login names and the commands used to retrieve passwords.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it allows the agent to read and process untrusted content from external email sources.
Ingestion points: The agent ingests data from email envelopes and messages using himalaya envelope list and himalaya message read as described in SKILL.md.
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between its own instructions and the content of the emails being read.
Capability inventory: The skill provides capabilities to send emails (himalaya message write, himalaya template send) and download potentially malicious attachments (himalaya attachment download).
Sanitization: No sanitization or content validation mechanisms are implemented before the data is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing the himalaya binary and other shell commands (like pass and cat) to perform its primary functions, which is an expected behavior for a CLI-based skill.

himalaya