The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes the agent to untrusted data from external IMAP servers, creating a surface for Indirect Prompt Injection.
Ingestion points: The himalaya message read and himalaya envelope list commands in SKILL.md allow the agent to ingest content from external, untrusted sources (emails).
Boundary markers: The skill documentation does not define specific delimiters or instructions to help the agent distinguish between system commands and potentially malicious instructions embedded in email bodies.
Capability inventory: The agent has access to sensitive tools such as himalaya message write (send emails), himalaya message delete (delete emails), and himalaya attachment download (write to filesystem), which could be abused if the agent is influenced by email content.
Sanitization: No sanitization or filtering of email content is described before it is processed by the agent.
[COMMAND_EXECUTION]: The Himalaya configuration supports executing arbitrary shell commands to retrieve credentials for email accounts.
Evidence: The backend.auth.cmd setting (documented in SKILL.md and references/configuration.md) allows the CLI to execute a specified command (e.g., pass show email/imap) to obtain passwords. While intended for integration with password managers, this feature could be exploited if the configuration file is modified to execute malicious payloads.
[DATA_EXFILTRATION]: The MML (MIME Meta Language) composition format supports attaching arbitrary local files, which could be used for data exfiltration.
Evidence: The syntax <#part filename=/path/to/file.pdf> in references/message-composition.md allows specifying local file paths for attachments. If an agent is manipulated via indirect prompt injection to include a sensitive file path (e.g., ~/.ssh/id_rsa) in an outgoing message, the tool will attach and send that file.

himalaya