Himalaya

CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple acc...

Security Scan

This is an instruction-only integration for the Himalaya email CLI and its requirements and instructions are consistent with that purpose; it asks for no unrelated credentials or privileged system changes, though it does rely on local email credentials and access to local files which is expected for an email client.

Purpose & Capability

The skill name/description match the declared requirements: it needs the himalaya binary and offers a brew install for it. There are no unrelated binaries, env vars, or config paths requested.

Instruction Scope

SKILL.md instructs the agent to use a config file at ~/.config/himalaya/config.toml, run himalaya commands, and (optionally) use password helpers (pass, keyring, security). These are appropriate for an email CLI, but the instructions also show examples that (a) can store raw passwords in the config (marked as 'testing only') and (b) invoke external password commands (e.g., pass show ... or security find-generic-password -w) which will execute commands that produce secrets. The docs also allow attaching local files via MML (filename=/path/to/...), which means the CLI will access arbitrary local paths if used that way. None of this is unexpected for an email client, but it is sensitive and worth noting.

Install Mechanism

Install is a Homebrew formula 'himalaya' which is a standard, low-risk install mechanism for a CLI. No arbitrary downloads or custom extraction steps are used.

Credentials

The skill does not request environment variables or credentials via the skill manifest. The documented configuration appropriately requires IMAP/SMTP credentials (via raw, cmd, or keyring), which is proportional for an email client. Users should prefer keyring or a secure password helper rather than embedding raw passwords in config. Using auth.cmd runs arbitrary helper commands (e.g., pass) so the helper’s behavior and permissions matter.

Persistence & Privilege

The skill is not always-enabled and does not request persistent system-level privileges or modify other skills. It is user-invocable and allows autonomous invocation (the platform default), which is expected for skills.

Assessment

This skill is coherent for managing email via the Himalaya CLI. Before installing: (1) verify you trust the Homebrew formula/source (the homepage points to the GitHub repo), (2) avoid placing raw passwords in ~/.config/himalaya/config.toml — prefer the system keyring or a vetted password helper, (3) review any password helper commands you configure (auth.cmd) because they will be executed to retrieve secrets, and (4) be mindful that composing MML messages may reference local files (attachments) so don’t use the skill to auto-attach sensitive files unless you intend to. If you want extra caution, install the CLI manually, inspect it locally, and confine credentials to a secure store before using the skill.

Himalaya Email CLI

Himalaya is a CLI email client that lets you manage emails from the terminal using IMAP, SMTP, Notmuch, or Sendmail backends.

References

• references/configuration.md (config file setup + IMAP/SMTP authentication)
• references/message-composition.md (MML syntax for composing emails)

Prerequisites

1. Himalaya CLI installed (himalaya --version to verify)
2. A configuration file at ~/.config/himalaya/config.toml
3. IMAP/SMTP credentials configured (password stored securely)

Configuration Setup

Run the interactive wizard to set up an account:

himalaya account configure

Or create ~/.config/himalaya/config.toml manually:

[accounts.personal]
email = "[e-mail]"
display-name = "Your Name"
default = true

backend.type = "imap"
backend.host = "imap.example.com"
backend.port = 993
backend.encryption.type = "tls"
backend.login = "[e-mail]"
backend.auth.type = "password"
backend.auth.cmd = "pass show email/imap"  # or use keyring

message.send.backend.type = "smtp"
message.send.backend.host = "smtp.example.com"
message.send.backend.port = 587
message.send.backend.encryption.type = "start-tls"
message.send.backend.login = "[e-mail]"
message.send.backend.auth.type = "password"
message.send.backend.auth.cmd = "pass show email/smtp"

Common Operations

List Folders

himalaya folder list

List Emails

List emails in INBOX (default):

himalaya envelope list

List emails in a specific folder:

himalaya envelope list --folder "Sent"

List with pagination:

himalaya envelope list --page 1 --page-size 20

Search Emails

himalaya envelope list from [e-mail] subject meeting

Read an Email

Read email by ID (shows plain text):

himalaya message read 42

Export raw MIME:

himalaya message export 42 --full

Reply to an Email

Interactive reply (opens $EDITOR):

himalaya message reply 42

Reply-all:

himalaya message reply 42 --all

Forward an Email

himalaya message forward 42

Write a New Email

Interactive compose (opens $EDITOR):

himalaya message write

Send directly using template:

cat << 'EOF' | himalaya template send
From: [e-mail]
To: [e-mail]
Subject: Test Message

Hello from Himalaya!
EOF

Or with headers flag:

himalaya message write -H "To:[e-mail]" -H "Subject:Test" "Message body here"

Move/Copy Emails

Move to folder:

himalaya message move 42 "Archive"

Copy to folder:

himalaya message copy 42 "Important"

Delete an Email

himalaya message delete 42

Manage Flags

Add flag:

himalaya flag add 42 --flag seen

Remove flag:

himalaya flag remove 42 --flag seen

Multiple Accounts

List accounts:

himalaya account list

Use a specific account:

himalaya --account work envelope list

Attachments

Save attachments from a message:

himalaya attachment download 42

Save to specific directory:

himalaya attachment download 42 --dir ~/Downloads

Output Formats

Most commands support --output for structured output:

himalaya envelope list --output json
himalaya envelope list --output plain

Debugging

Enable debug logging:

RUST_LOG=debug himalaya envelope list

Full trace with backtrace:

RUST_LOG=trace RUST_BACKTRACE=1 himalaya envelope list

Tips

• Use himalaya --help or himalaya <command> --help for detailed usage.
• Message IDs are relative to the current folder; re-list after folder changes.
• For composing rich emails with attachments, use MML syntax (see references/message-composition.md).
• Store passwords securely using pass, system keyring, or a command that outputs the password.