The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing the himalaya CLI for all operations, including account setup and email management.
[DATA_EXFILTRATION]: The skill manages sensitive email data and credentials. It documents how to store passwords in ~/.config/himalaya/config.toml, including a discouraged example of plain-text storage (backend.auth.raw).
[EXTERNAL_DOWNLOADS]: The skill metadata includes instructions to download and install the himalaya binary using the Homebrew package manager.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes untrusted content from the internet (emails).
Ingestion points: Untrusted data enters the agent context through himalaya envelope list and himalaya message read as seen in SKILL.md.
Boundary markers: The instructions do not define delimiters or provide warnings to the agent to disregard instructions embedded within email bodies.
Capability inventory: The skill provides the agent with powerful capabilities, including sending emails (himalaya message write), deleting messages (himalaya message delete), and downloading attachments to the local filesystem (himalaya attachment download) (documented in SKILL.md).
Sanitization: There is no evidence of sanitization or validation of the email content before it is passed to the agent's context.

himalaya