openhands-automation
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides templates for installing the
uvpackage manager via its official installation script from astral.sh. - [COMMAND_EXECUTION]: Utilizes curl for API interactions with the OpenHands Automation service to manage lifecycle operations like creation, updates, and deletion.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle potentially untrusted data from webhook payloads (GitHub, Jira, etc.). It includes a dedicated security guide (references/security.md) that instructs agents on how to safely process this content as data rather than instructions.
- [REMOTE_CODE_EXECUTION]: Supports the execution of automation logic packaged as tarballs, which can be loaded from remote sources such as HTTPS URLs or cloud storage (S3, GCS).
Audit Metadata