Security audit

Himalaya Cli

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent email CLI helper skill, but users should handle mail credentials and destructive email commands carefully.

Install only if you intend to let Codex help operate your Himalaya email account. Prefer pass, system keyring, or another secret manager instead of plaintext auth.raw values, verify recipients before sending, confirm message IDs before deleting, and download attachments only from messages you trust.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

Category: Privilege Escalation
Content: ### System keyring (requires keyring feature) ```toml backend.auth.keyring = "imap-example" ``` Then run `himalaya account configure <account>` to store the password.
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: ### System keyring (requires keyring feature) ```toml backend.auth.keyring = "imap-example" ``` Then run `himalaya account configure <account>` to store the password.
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

Category: Rogue Agent
Content: himalaya account configure ``` Or create `~/.config/himalaya/config.toml` manually: ```toml [accounts.personal] email = "you@example.com"
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This markdown file documents `himalaya message delete 42` as a common operation, but provides no warning that it deletes user data or may be difficult to undo depending on backend/server behavior. For markdown files, the skill description should warn about behaviors that can affect user data or system integrity.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The primary setup example embeds `backend.auth.raw = "your-password"` for both IMAP and SMTP in the main configuration block, which normalizes storing credentials directly in plaintext config files under the user's home directory. Even though a later section says raw passwords are for testing only, placing plaintext secrets in the default example increases the chance users will copy it verbatim, exposing mail credentials to local compromise, backups, screenshots, or accidental commits.

Missing User Warnings

Low

Confidence: 75% confidence
Finding: The file shows commands that send email content and recipient information via SMTP, but does not include any warning that message contents and addressing data will be transmitted to configured mail servers. For markdown files, behaviors affecting privacy should be disclosed.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The attachments section instructs users to download attachments, including to `~/Downloads`, but does not warn that this creates local files that may contain sensitive data. Markdown skill descriptions should disclose behaviors that affect user data or privacy.

Static analysis

No suspicious patterns detected.