The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation and dual-box setup instructions direct users to execute a remote shell script using the pattern bash <(curl -fsSL ...). The script is hosted at https://raw.githubusercontent.com/StartupHakk/OpenMonoAgent.ai/refs/heads/main/get-openmono.sh, which belongs to a third-party repository not included in verified trusted lists. This pattern allows for the immediate execution of unvetted code with the privileges of the local shell.
[COMMAND_EXECUTION]: The agent is equipped with powerful tools, including run_command and Docker management capabilities. While these are intended for legitimate coding tasks, they provide a direct mechanism for executing arbitrary shell commands, which can be abused if the agent is misdirected.
[INDIRECT_PROMPT_INJECTION]: The skill operates as a coding assistant that ingests content from the local project environment, creating a vulnerability to malicious instructions embedded in data.
Ingestion points: The agent reads local source code, project configuration files, and outputs from Language Server Protocol (LSP) and Model Context Protocol (MCP) integrations.
Boundary markers: The documentation identifies path-level sanity checks but does not describe the use of clear delimiters or instructions to the LLM to ignore potentially malicious directions within the ingested project files.
Capability inventory: The agent has permissions to read/write files, execute system commands, and modify network relay configurations.
Sanitization: Security measures appear focused on preventing path traversal rather than sanitizing the content of analyzed files for adversarial prompts.

openmonoagent-local-ai-coding-agent