Email Reader

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:28 PM UTC
• Version: 1.0.0

Overview

This email-management skill is coherent, but it handles sensitive mailbox access and outbound email authority with weak scoping and unsafe credential examples.

Install only if you are comfortable giving the agent and the configured CLI access to your mailbox and the ability to send or modify messages. Use a provider-supported OAuth or keychain/secret-helper flow where possible, avoid entering real passwords in shell commands, pin or verify the CLI package before installing, and require confirmation before sending or deleting email.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

cargo install himalaya

Technical Analysis

The installation command does not specify an exact Himalaya version, use a locked dependency graph, or require integrity verification. It therefore retrieves and builds whichever package version is current in the configured Cargo registry when the command is executed.

This makes the effective installed code mutable after the skill has been audited. If the package, its registry account, or one of its resolved dependencies is compromised, following this instruction could build and install attacker-controlled code. Cargo build scripts and compiled binaries can execute code locally, so dependency integrity is security-critical.

The project also provides unpinned Homebrew and Winget installation examples at SKILL.md:41 and SKILL.md:47. Those installation paths should likewise be constrained to trusted, verified releases where the package manager supports doing so.

Attack Path

1. An attacker compromises the upstream package, publisher account, registry distribution path, or a transitive dependency.
2. A malicious release is published under the expected package identity.
3. A user follows the documented cargo install himalaya instruction.
4. Cargo resolves the mutable latest release and its dependency graph.
5. Malicious build logic or the resulting executable runs on the user's system.
6. The malicious component acts with the privileges of the user performing the installation or subsequently running the mail client.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that account's permissions, an attacker could access local files, environment variables, configured email credentials, OAuth ...[truncated 174 chars]

Remediation

View remediation

Remediation Suggestions

• Pin an explicitly audited release and its dependency graph:

  bash

  cargo install himalaya --version <exact-version> --locked
  

• Document the official package identity and trusted registry source to reduce dependency-confusion and typosquatting risks.
• Verify release signatures or checksums where the publisher provides them.
• Review the pinned package's build scripts and transitive dependencies before recommending installation.
• Pin or otherwise verify the Homebrew and Winget installation paths as well.
• Run installation and the resulting client without administrative privileges and within a restricted environment where practical.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:50

Finding

Email Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:50-59; references/resources.md:5-13; references/resources.md:15-23
Vulnerability Type: Sensitive credentials supplied as plaintext command-line arguments
Risk Level: High

Vulnerable Code from SKILL.md:50-59:

bash

### Configuration
```bash
himalaya envelope add --name personal \
  --imap-host imap.example.com \
  --imap-port 993 \
  --smtp-host smtp.example.com \
  --smtp-port 587 \
  --username [e-mail] \
  --password "your-password"

text

**Vulnerable Gmail Configuration from `references/resources.md:5-13`**:
```text
### Gmail

--imap-host imap.gmail.com --imap-port 993 --smtp-host smtp.gmail.com --smtp-port 587 --username [e-mail] --password "app-password"

text

Vulnerable QQ Mail Configuration from references/resources.md:15-23:

text

### QQ Mail

--imap-host imap.qq.com --imap-port 993 --smtp-host smtp.qq.com --smtp-port 587 --username [e-mail] --password "auth-code"

text

Technical Analysis

These examples encourage users to substitute real mailbox passwords, application passwords, or authorization codes directly into command-line arguments. Command arguments may be retained in shell history and can be captured by terminal recordings, automation logs, monitoring systems, or process-inspection facilities available to other local principals.

The practice conflicts with the later recommendation at SKILL.md:90 to store sensitive information outside logs. Quoting the value prevents basic shell word splitting but does not protect its confidentiality.

Attack Path

1. A user replaces the placeholder with a real email password, application password, or authorization code.
2. The user executes or stores the command in a shell, script, terminal session, or automated job.
3. The secret is retained in shell history, exposed in process metadata while the ...[truncated 1099 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all examples that pass secrets through --password command-line arguments.
• Use Himalaya's supported secure credential integration, such as an operating-system keychain, secret-command provider, protected credential helper, or interactive secret prompt.
• Prefer OAuth with minimum required scopes when the provider and client support it.
• Avoid plain environment variables when a keychain or credential helper is available because environment values can also leak through diagnostics or inherited process environments.
• If a credential file is unavoidable, store it outside the project, restrict its permissions to the owning user, exclude it from version control, and prevent it from entering logs or backups.
• Add instructions for rotating any password, application password, or authorization code that was previously entered on a command line.
• Ensure examples use placeholders only and explicitly warn users never to substitute secrets directly into shell commands.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables reading private emails and sending messages as the user, but it does not prominently warn about these privacy- and authority-sensitive capabilities. Without clear disclosure and consent expectations, users may unknowingly expose sensitive communications or authorize actions that affect third parties.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough that the skill may activate for generic requests like checking messages or reminders, leading to access to mailbox contents or email-sending behavior without sufficiently explicit user authorization. In an email-management skill, ambiguous invocation is especially risky because mailbox data is highly sensitive and outbound email actions can impersonate the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file includes himalaya envelope delete <id> as a common command, but provides no warning that it deletes mail and may be irreversible depending on server settings. For markdown files, safety-affecting behaviors should be disclosed so users understand the potential impact on their data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction '用中文总结给用户' mandates a specific language for output regardless of user preference. This is a locale/language policy concern because the file does not offer an opt-in choice or justify why Chinese is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

All headings and usage guidance in the file are presented only in Chinese, with no note that the resource is intended for Chinese-speaking users or that other language options exist. The policy requires flagging language constraints when a specific language is forced without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.