himalaya
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the
himalayaCLI using a script from a well-known source (https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh) or via official package managers like Homebrew and Cargo. - [REMOTE_CODE_EXECUTION]: The installation section includes a recommended pattern (
curl | sh) for installing the binary. While this pattern carries inherent risks, it points to a well-known repository for the specific tool the skill is designed to support. - [COMMAND_EXECUTION]: The skill operates by executing
himalayaCLI commands to interact with email servers. It provides patterns for piping content to standard input and using shell features likesedandcatfor non-interactive email composition. - [CREDENTIALS_UNSAFE]: The configuration reference mentions
backend.auth.rawfor testing but explicitly warns against its use, recommending safer alternatives likepass(GPG-based password store),security(macOS keychain), or system keyrings. The examples use placeholders likeyour-passwordrather than actual secrets.
Audit Metadata