The Agent Skills Directory

[PROMPT_INJECTION]: The skill establishes a surface for Indirect Prompt Injection by enabling the agent to ingest and process untrusted data from external sources (incoming emails).
Ingestion points: The himalaya message read and himalaya envelope list commands in SKILL.md bring external email content into the agent's context.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore instructions embedded within the email body.
Capability inventory: The skill provides significant capabilities, including himalaya message write, himalaya message delete, himalaya message move, and himalaya message forward, which could be triggered by malicious email content.
Sanitization: There is no mention of sanitizing or filtering email content before it is processed by the agent.
[COMMAND_EXECUTION]: The documentation in references/configuration.md details the backend.auth.cmd configuration option. This feature allows the underlying tool to execute arbitrary shell commands to retrieve passwords. While intended for security (e.g., integrating with pass or security), it provides a mechanism for dynamic command execution based on local configuration files.
[DATA_EXFILTRATION]: The skill facilitates access to sensitive communication data. The himalaya message read and himalaya message export --full commands allow the agent to access plain text and raw MIME data of emails, which could lead to data exposure if the agent's context is compromised.

himalaya