Security audit
Security checks for vulnerabilities and agentic risk
This Himalaya email CLI skill is coherent, but it gives broad email-management guidance including send and destructive mailbox commands without clear safety gates.
Install only if you intend agents to help with Himalaya CLI email workflows. Before allowing generated commands to run, review account, folder, message IDs, recipients, and any delete/purge/expunge or send/reply/forward actions yourself.
The skill says to use it for "ANY task involving" listing, reading, writing, replying, forwarding, flags, folders, attachments, and query construction. That scope is so broad that it can overlap with many ordinary email requests that may not specifically require the Himalaya CLI, increasing the risk of unintended invocation.
The skill provides operational guidance for sending messages and destructive mailbox actions such as delete, purge, and expunge without explicit safety gates, confirmation requirements, or warnings about irreversible effects. In an agent setting, this increases the chance that a model could translate a loosely phrased user request into real external or destructive actions affecting email state or sending outbound mail.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Compose a new message interactively
himalaya message write
# Pre-fill headers via CLI arguments
himalaya message write --to "team@example.com" --subject "Sprint review"
No suspicious patterns detected.