himalaya-v2
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone and install software from GitHub (pimalaya/himalaya) and a third-party Homebrew tap (cometkim/tap/op-fast). These are required for the tool's operation.
- [COMMAND_EXECUTION]: The skill relies on executing various CLI commands (himalaya, git, cargo, brew) and a provided Python script (scripts/message-preview.py) to manage emails, install software, and process data.
- [PROMPT_INJECTION]: The skill processes untrusted email data, which represents an indirect prompt injection surface. Ingestion points: Email content is read into the context via the himalaya CLI and processed by scripts/message-preview.py. Boundary markers: No specific delimiters are used for the email data in the script, but the skill instructions enforce human-in-the-loop review for all sensitive actions. Capability inventory: The agent has the capability to send, delete, and move emails through the CLI tool. Sanitization: The scripts/message-preview.py script includes logic to strip HTML tags and extract URLs, providing a level of sanitization for the untrusted input.
- [SAFE]: The skill demonstrates security best practices by explicitly advising against storing raw passwords in configuration files and recommending the use of command-backed secret managers.
Audit Metadata