The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it allows the agent to read and process untrusted email content. • Ingestion points: The himalaya message read and himalaya envelope list commands in SKILL.md bring external email data into the agent's context. • Boundary markers: Absent; there are no instructions or delimiters defined to isolate untrusted email content from agent instructions. • Capability inventory: The skill has the capability to send emails (himalaya message write), download attachments (himalaya attachment download), and execute commands via the backend.auth.cmd setting in references/configuration.md. • Sanitization: Absent; there is no logic to filter or sanitize the content of emails before they are processed by the agent.
[COMMAND_EXECUTION]: The skill uses the himalaya CLI, which executes commands in the system shell. Furthermore, the configuration documentation in references/configuration.md describes the backend.auth.cmd feature, which executes arbitrary shell commands to retrieve passwords.
[DATA_EXFILTRATION]: The skill handles sensitive information including email contents and the configuration file located at ~/.config/himalaya/config.toml, which may store credentials or authentication commands.

himalaya