The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation instructions in SKILL.md suggest executing a remote shell script using curl -sSL ... | sh. This pattern allows for arbitrary code execution from a source not identified as a trusted vendor, posing a high risk of system compromise.
[CREDENTIALS_UNSAFE]: The skill requires access to ~/.config/himalaya/config.toml, which stores sensitive IMAP and SMTP authentication details. Managing this file through an agent increases the risk of credential exposure or unauthorized mailbox access.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (incoming emails) which can be used to influence agent behavior.
Ingestion points: The skill reads emails using himalaya envelope list and himalaya message read as described in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to isolate untrusted email content from its instruction set.
Capability inventory: The skill allows the agent to send, move, and delete emails, creating a path for automated actions based on malicious content in an email.
Sanitization: The instructions do not include any sanitization or validation of the email content before processing.
[COMMAND_EXECUTION]: The skill extensively uses shell piping and heredoc patterns (e.g., cat << EOF | himalaya template send) to handle message content. If the email content or headers contain shell metacharacters, it could lead to command injection vulnerabilities.

himalaya