himalaya

Fail

Audited by Socket on Mar 1, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

This skill/README documents a terminal email client and its expected configuration and usage. I found no indicators of deliberate malicious behavior in the supplied text: network calls are to user-configured IMAP/SMTP servers, installs reference standard sources (Homebrew/GitHub), and credential access is performed via recommended helpers (pass, keyring). Primary risks are operational: executing auth helper commands (auth.cmd) and running the native himalaya binary both require trusting local commands and the binary itself. Protect the configuration and password helper stores; verify the himalaya binary from official sources. No evidence of credential harvesting, third-party proxying, or hidden backdoors in this fragment.

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Mar 1, 2026, 05:15 AM
Package URL
pkg:socket/skills-sh/ThinkfleetAI%2Fthinkfleet-engine%2Fhimalaya%2F@9e81db2332ce0e4d00d53e9532f4ec1361c7b76c