run-agent
Configures and runs agents with different adapters including Claude, OpenAI, CrewAI, Lyzr, and GitHub Models. Supports local execution, remote git repos, and one-shot prompts. Use when the user wants to run an agent, switch LLM providers, configure adapter settings, or launch agents from git repositories.
76
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow supports running agents from a git repo via `opengap run -r https://...`, which at runtime will clone and then read outsider-authored repository text (e.g., framework files like `CLAUDE.md`, `.cursorrules`, `crew.yaml`, `.lyzr_agent_id`, `.github_models`) into the agent’s prompt/context for adapter selection or execution, creating indirect prompt-injection risk.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill documentation shows that the tool will clone and run code from a remote git repository at runtime (e.g., "opengap run -r https://github.com/user/agent"), meaning fetched content can directly control prompts or execute code, so the URL https://github.com/user/agent is a runtime dependency that affects agent behavior.
- Repository
- open-gitagent/opengap
- Commit
d7a8e2e
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.