Security audit

himalaya

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Himalaya email CLI skill, with normal email-account risks around credentials, sending messages, attachments, and deletion.

Install this only if you want the agent to help operate your email account through Himalaya. Use pass, keyring, OAuth, or another secret manager instead of raw passwords in config files, and require review before any send, reply-all, forward, attachment, move, or delete command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

Category: Privilege Escalation
Content: backend.encryption.type = "tls" backend.login = "you@example.com" backend.auth.type = "password" backend.auth.cmd = "pass show email/imap" # or use keyring message.send.backend.type = "smtp" message.send.backend.host = "smtp.example.com"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: backend.encryption.type = "tls" backend.login = "you@example.com" backend.auth.type = "password" backend.auth.cmd = "pass show email/imap" # or use keyring message.send.backend.type = "smtp" message.send.backend.host = "smtp.example.com"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

Category: Rogue Agent
Content: himalaya account configure ``` Or create `~/.config/himalaya/config.toml` manually: ```toml [accounts.personal] email = "you@example.com"
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill includes explicit examples for composing and sending email, which causes user-provided content to be transmitted to external recipients, but it does not warn about exfiltration or confirm that outbound network delivery will occur. In an agent setting, this matters because a user may provide sensitive text, headers, or attachments assuming local-only drafting behavior when the command can actually send data off-host.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents `himalaya message delete` as a direct action without warning that it is destructive and may permanently remove mail or alter mailbox state. In an automated or agent-driven context, this increases the risk of unintended data loss because the user is not prompted to verify before deletion.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The primary setup example shows `backend.auth.raw` and `message.send.backend.auth.raw` with plaintext passwords directly in the config, while the warning that this is only for testing appears later and is not adjacent to the main example. Users often copy the first complete example verbatim, which can lead to long-lived plaintext credential storage in `~/.config/himalaya/config.toml`, increasing exposure through backups, local compromise, screen sharing, or accidental commits.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: This markdown file includes examples for attaching arbitrary local files to outgoing emails, which can expose sensitive data if used carelessly. The surrounding documentation explains how to do this but does not include any warning about verifying attachment paths or checking recipients before sending.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The markdown shows commands for sending composed messages and states that saving and exiting the editor sends the email. Because email transmission can affect user data and privacy, the skill description should explicitly warn users to confirm recipients and content before sending.

Static analysis

No suspicious patterns detected.