Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This skill is a set of instructions for using the Himalaya email tool from a terminal. It tells an agent how to install the tool, configure email accounts, list/read/send/forward/delete messages, manage folders and attachments, and compose rich emails. The instructions require shell access and access to the user's email credentials, and they also show how to download attachments. No hidden network destinations, obfuscated code, persistence mechanisms, or attempts to override the agent's rules were found. Because it deals with sensitive credentials and can send email or download files, a user should review it carefully before installation.
| Declared purpose | CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language). |
| Observed behavior | The package is documentation and examples. It declares a Homebrew install for himalaya and instructs shell commands such as `himalaya account configure`, `himalaya envelope list`, `himalaya template send`, and `himalaya attachment download`. Configuration examples include email account passwords, command-based secret retrieval, and OAuth2 token settings. It also warns against plaintext password use. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill repeatedly instructs running himalaya CLI commands and a bash heredoc, for example SKILL.md line 27 and line 124. |
| install_packages | needed | SKILL.md metadata instructs installing himalaya via Homebrew using the formula himalaya. |
| filesystem_write | needed | Commands can create or update configuration at ~/.config/himalaya/config.toml and download email attachments to disk. |
| filesystem_read | needed | The skill requires reading the Himalaya config file and can attach local files to outgoing email through MML. |
| credentials | needed | Configuration examples include email passwords and OAuth secrets. The skill recommends pass/keyring but also documents a raw password field. |
| network | needed | Himalaya operations use IMAP/SMTP/OAuth to user-configured mail servers. The only domains present are clawhub.ai, github.com, and an example placeholder provider.com. |
| severity | finding |
|---|---|
| info | Declares Homebrew installation of himalaya The skill metadata tells the agent/runtime to install the himalaya CLI via Homebrew. This is a third-party package install and is consistent with the skill's declared purpose. SKILL.md:5 metadata: {"clawdbot":{"emoji":"📧","requires":{"bins":["himalaya"]},"install":[{"id":"brew","kind":"brew","formula":"himalaya","bins":["himalaya"],"label":"Inst |
| info | Instructs shell-based account setup The skill instructs running an interactive Himalaya command to configure an email account. This requires shell access to the himalaya binary. SKILL.md:27 himalaya account configure |
| low | Can send email from supplied text The skill shows how to pipe a composed message into `himalaya template send`. An agent following this could send email from configured accounts; this is part of managing email but should be reviewed. SKILL.md:124 cat << 'EOF' | himalaya template send |
| low | Downloads email attachments to disk Attachment downloads write files to the local filesystem, and line 189 shows writing to a chosen directory. This is expected for email management, but attachments can carry malicious content. SKILL.md:184 himalaya attachment download 42 |
| medium | Documents raw password storage The example stores an email password directly in a TOML config file. If copied, this places credentials in plaintext; line 34 notes 'testing only, not recommended' and line 41 recommends a command instead. references/configuration.md:20 backend.auth.raw = "your-password" |
| low | Configures command-based credential retrieval The skill instructs Himalaya to execute a command such as `pass` or `security find-generic-password` to retrieve email credentials. This is a shell-command based secret source and should be reviewed. references/configuration.md:41 backend.auth.cmd = "pass show email/imap" |
| info | OAuth URL is a placeholder The OAuth2 example points to provider.com, an example placeholder domain, not a hidden destination. No hard-coded credential exfiltration endpoint is present. references/configuration.md:151 backend.auth.auth-url = "https://provider.com/oauth/authorize" |
| info | Publisher discloses credential exposure risk The skill card explicitly warns about credential exposure and recommends command-based secret storage on line 26. skill-card.md:24 Risk: Email credentials could be exposed if plaintext password examples are copied into shared, backed-up, or source-controlled configuration files. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| github.com | not in the service index | SKILL.md:4 |
| provider.com | not in the service index | references/configuration.md:151 |
| Binaries invoked | bash |
| Environment variables read | EDITOR |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 217 | 2265054da976a3d9… |
_meta.json | 6 | da9754eb04a63644… |
references/configuration.md | 174 | af8ce863062d00f6… |
references/message-composition.md | 182 | ac84822e20489d4b… |
skill-card.md | 50 | 5dfb2e7dfd9fe262… |
For agents
JSON: https://agenteconomy.report/k/himalaya.audit.json · badge: https://agenteconomy.report/k/himalaya.audited.svg ·
skill rating: /k/himalaya · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).