The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides installation instructions that use a piped shell execution pattern (curl -sSL ... | sh).
Evidence: The installation section in SKILL.md suggests fetching an installation script from https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh and piping it directly to sh. While this targets the official repository for the Himalaya CLI tool, this execution pattern is inherently risky.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (emails) and possesses capabilities that could be abused if the agent follows instructions embedded within that data.
Ingestion points: The agent reads external content via himalaya message read, himalaya envelope list, and himalaya message export (all in SKILL.md).
Boundary markers: There are no instructions or delimiters defined to separate the email content from the agent's system instructions, increasing the risk of the agent obeying commands found within emails.
Capability inventory: The skill provides full email management capabilities, including sending emails (himalaya template send), deleting messages (himalaya message delete), and downloading attachments (himalaya attachment download).
Sanitization: There is no mention of sanitizing, escaping, or filtering the email content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing various subcommands through the himalaya CLI tool, which is the primary mechanism for its functionality.

himalaya