openhands-api

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's clients and docs explicitly instruct agents to fetch and read conversation events, trajectories, and workspace files from OpenHands Cloud (e.g., GET /api/conversations/{id}/events, /trajectory, /list-files, /select-file against https://app.all-hands.dev) — these are untrusted, user-generated third-party contents the agent is expected to interpret as part of its workflow and could materially change subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's client calls the OpenHands cloud at https://app.all-hands.dev at runtime (POST /api/conversations and related endpoints) to start and monitor autonomous conversations that can execute actions (implement changes, run tests, open PRs), so the remote URL directly controls agent instructions and execution.