ClawHub
Back to skill

Security audit

Himalaya Email CLI

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Himalaya email CLI helper; it handles sensitive email operations but the behavior is visible and aligned with managing mail from the terminal.

Install only if you intend to let the agent help operate a configured email account through Himalaya. Review recipients and account selection before sending, confirm message IDs before moving or deleting mail, and prefer pass, keyring, or app-password commands instead of storing raw passwords in the config file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Content
backend.encryption.type = "tls"
backend.login = "you@example.com"
backend.auth.type = "password"
backend.auth.cmd = "pass show email/imap"  # or use keyring

message.send.backend.type = "smtp"
message.send.backend.host = "smtp.example.com"
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
backend.encryption.type = "tls"
backend.login = "you@example.com"
backend.auth.type = "password"
backend.auth.cmd = "pass show email/imap"  # or use keyring

message.send.backend.type = "smtp"
message.send.backend.host = "smtp.example.com"
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium
Category
Rogue Agent
Content
himalaya account configure
```

Or create `~/.config/himalaya/config.toml` manually:
```toml
[accounts.personal]
email = "you@example.com"
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill instructs users how to compose and send emails, including piping message bodies and headers directly to the CLI, but does not mention that message content, recipients, and account metadata will be transmitted to external mail servers. For markdown files, behaviors affecting user privacy should be clearly disclosed.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This markdown file includes a direct example for deleting an email via `himalaya message delete 42`, but provides no warning that the action may remove user data or be hard to reverse depending on server/account behavior. Under the markdown-specific warning criteria, destructive operations affecting user data should be accompanied by a clear caution.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation includes complete working examples with `backend.auth.raw` and `message.send.backend.auth.raw` set to plaintext passwords in a user config file under the home directory. Although labeled 'testing only, not recommended', this still normalizes insecure credential storage and can lead users to persist secrets in readable files, backups, screenshots, dotfile repos, or shared systems.

Static analysis

No suspicious patterns detected.