himalaya
Audited by Socket on Mar 1, 2026
1 alert found:
MalwareThis skill/README documents a terminal email client and its expected configuration and usage. I found no indicators of deliberate malicious behavior in the supplied text: network calls are to user-configured IMAP/SMTP servers, installs reference standard sources (Homebrew/GitHub), and credential access is performed via recommended helpers (pass, keyring). Primary risks are operational: executing auth helper commands (auth.cmd) and running the native himalaya binary both require trusting local commands and the binary itself. Protect the configuration and password helper stores; verify the himalaya binary from official sources. No evidence of credential harvesting, third-party proxying, or hidden backdoors in this fragment.