The Agent Skills Directory

[SAFE]: The skill provides a standard and safe implementation for interacting with the Himalaya email CLI tool.
[COMMAND_EXECUTION]: The skill uses the himalaya binary to execute mailbox management tasks. All commands are intended for local execution to perform authorized email operations.
[DATA_EXFILTRATION]: The skill accesses sensitive data, including email content and local account configurations (~/.config/himalaya/config.toml). This access is restricted to the agent's task of managing the user's email and does not involve any unauthorized external data transmission.
[PROMPT_INJECTION]: The skill contains explicit instructions to prevent the agent from sending or composing emails. It also identifies an indirect prompt injection surface due to the processing of untrusted email data.
Ingestion points: Email content is retrieved via himalaya message read (SKILL.md).
Boundary markers: No specific delimiters or safety warnings are present to separate untrusted email content from agent instructions.
Capability inventory: The agent has capabilities to delete messages, move folders, and download attachments (SKILL.md).
Sanitization: No sanitization of ingested email content is defined.
Note: This vulnerability surface is inherent to the primary purpose of an email client and does not escalate the verdict.
[CREDENTIALS_UNSAFE]: The reference documentation correctly illustrates the use of placeholders and secure command-based password retrieval (pass), avoiding the exposure of actual credentials.

himalaya