The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted content from GitHub comments and interpolates it into the prompt of a secondary agent.\n
Ingestion points: In main.py, the _poll_issue_comments and _poll_pr_review_comments functions fetch raw comment bodies from the GitHub API.\n
Boundary markers: The _build_initial_prompt function uses triple dashes (---) to delimit external content, which provides some structural separation but does not prevent instructions within the comments from influencing the agent.\n
Capability inventory: The triggered agent is granted access to the terminal and file_editor tools and has access to the user's GITHUB_PERSONAL_ACCESS_TOKEN.\n
Sanitization: There is no evidence of sanitization or filtering of the comment content beyond the trigger phrase check.\n- [COMMAND_EXECUTION]: The skill's setup workflow in SKILL.md requires the agent to execute shell commands to package the automation script (tar) and upload it to the OpenHands backend service via curl. These are legitimate operations within the context of creating a new automation.\n- [EXTERNAL_DOWNLOADS]: The main.py script makes network requests to the official GitHub API (api.github.com) to poll for new events and post response comments. These requests are conducted through a well-known service and are necessary for the skill's intended functionality.

github-repo-monitor