The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue and pull request comments. This creates a surface where an external attacker could attempt to influence the agent's behavior through malicious comments.
Ingestion points: In scripts/main.py, the functions _poll_issue_comments and _get_issue_context ingest untrusted text from the GitHub API.
Boundary markers: The skill provides a mitigation by explicitly instructing the agent in _build_initial_prompt (within scripts/main.py) to treat user-provided content as data/requests rather than instructions that override the system prompt.
Capability inventory: When in implement mode, the responding agent is granted powerful capabilities, including terminal and file_editor access, as defined in the _get_agent_dict function.
Sanitization: Untrusted data is wrapped in --- delimiters within the generated prompt to differentiate it from instructions.
[COMMAND_EXECUTION]: The setup process described in SKILL.md requires the agent to execute several shell commands, including curl for API verification, tar for packaging the automation, and mkdir for managing build directories.
[EXTERNAL_DOWNLOADS]: The automation script (scripts/main.py) performs frequent network operations to the GitHub API (api.github.com) to retrieve comment data. It also communicates with the internal OpenHands automation backend and KV store for state management.

github-repo-monitor