The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface detected. The skill provides commands to read email content (e.g., himalaya message read in SKILL.md), which constitutes untrusted external data. This data could contain instructions designed to influence the agent's behavior.
Ingestion points: Reading emails via himalaya message read and himalaya message export.
Boundary markers: None identified in the provided instructions to delimit email content from agent instructions.
Capability inventory: The skill can send emails, download attachments, and modify email flags, providing a feedback loop for potential attackers.
Sanitization: No sanitization or validation of email content is mentioned before processing.
[COMMAND_EXECUTION]: The skill relies on the execution of the himalaya CLI tool. Additionally, the configuration reference in references/configuration.md documents the backend.auth.cmd feature, which allows the execution of arbitrary shell commands (e.g., pass show email/imap) to retrieve passwords at runtime.
[CREDENTIALS_UNSAFE]: The documentation in references/configuration.md illustrates the use of backend.auth.raw for storing passwords in plain text within the configuration file. While the provided value 'your-password' is a placeholder, this practice is noted as discouraged in the documentation itself.

himalaya