The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Every Python script in the scripts/ directory (e.g., create_repository.py, push_files.py) contains the hardcoded demo API key BETA_TEST_KEY_MARCH_2026 as a fallback value when the DEEPNLP_ONEKEY_ROUTER_ACCESS environment variable is not provided.
[COMMAND_EXECUTION]: The installation instructions in SKILL.md recommend a global npm installation (npm -g install @aiagenta2z/onekey-gateway), which typically requires elevated permissions (sudo/root) to execute.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external vendor packages @aiagenta2z/onekey-gateway (npm) and ai-agent-marketplace (pip) to interface with the OneKey Gateway API.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted data retrieved from GitHub while possessing extensive repository write capabilities.
Ingestion points: Untrusted data enters the agent context through tools such as get_file_contents.py, issue_read.py, and search_code.py.
Boundary markers: The provided scripts lack delimiters or specialized instructions to prevent the agent from executing commands embedded within the retrieved GitHub data.
Capability inventory: The skill has broad write permissions, including creating/updating files (create_or_update_file.py), deleting files (delete_file.py), and merging pull requests (merge_pull_request.py).
Sanitization: There is no evidence in the scripts of content validation or sanitization for data fetched from the GitHub API before it is processed.

github