Is there an existing feature request for this?
Problem or Use Case
As the OpenHands ecosystem grows and more community members contribute custom tools and skills, there is an increased risk of exposing credentials through a unique vulnerability in agent architectures known as Cross-Modal Leakage.
Standard secret scanners (like TruffleHog or GitLeaks) only scan source code for hardcoded API keys. However, when an agent executes code based on natural language instructions, new attack vectors appear:
- The Python code is secure (e.g., reading an API key securely from
.env).
- The Markdown/Natural Language prompt is benign (e.g., explaining how to use the tool).
- If the prompt accidentally instructs the agent to pass the credential to a sink (like
print() for debugging), the agent framework captures that stdout and injects it back into the LLM context window. The secret is now queryable or exposed!
We need a native way to automatically scan the intersection of natural language and code to catch these cross-modal leaks before new agent tools are merged into the repository.
Proposed Solution
Add a cross-modal static analysis step into the OpenHands CI/CD pipeline (and potentially as a pre-commit hook) that analyzes both the English instructions and the Python code simultaneously.
The ideal feature would use a dual-engine pipeline (NL Semantic Analyzer + AST Syntax Analyzer) to track variable flows between the prompt instructions and the python code sinks. If a prompt tricks the code into giving away API keys, the pipeline should fail and flag the specific lines causing the leak.
Alternatives Considered
- Traditional Secret Scanners (GitLeaks, TruffleHog): These only look for hardcoded static secrets in source code. They do not parse ASTs or correlate them with Natural Language instructions (like
SKILL.md), so they completely miss these leaks.
- Manual Code Review: Relying on maintainers to manually track variable flows from markdown instructions into python code sinks during code review is extremely time-consuming and error-prone.
Priority / Severity
High - Significant impact on productivity
Estimated Scope
Medium - New feature with moderate complexity
Feature Area
Agent / AI behavior
Technical Implementation Ideas (Optional)
We could implement a custom GitHub Action or CI step that parses the AST of the Python skills and correlates it with the semantic intents of the Markdown files.
I am very familiar with how to build this. In fact, I have built a standalone open-source project that does exactly this called Scankii.
Instead of just dropping a link, I would love to volunteer to build and integrate this feature natively into the OpenHands pipeline. We could adapt the logic I've already written in Scankii to perfectly fit OpenHands' skill architecture and CI/CD needs.
If the maintainers agree this is a valuable feature, I can submit a Pull Request to get it started!
Additional Context
- The vulnerability taxonomy for this comes from recent empirical research on LLM Agent Skills (e.g., "How Your Credentials Are Leaked by LLM Agent Skills", ASE 2026).
- Adding this proactively will ensure OpenHands remains the most secure agent framework as the community tool ecosystem scales.
Is there an existing feature request for this?
Problem or Use Case
As the OpenHands ecosystem grows and more community members contribute custom tools and skills, there is an increased risk of exposing credentials through a unique vulnerability in agent architectures known as Cross-Modal Leakage.
Standard secret scanners (like TruffleHog or GitLeaks) only scan source code for hardcoded API keys. However, when an agent executes code based on natural language instructions, new attack vectors appear:
.env).print()for debugging), the agent framework captures thatstdoutand injects it back into the LLM context window. The secret is now queryable or exposed!We need a native way to automatically scan the intersection of natural language and code to catch these cross-modal leaks before new agent tools are merged into the repository.
Proposed Solution
Add a cross-modal static analysis step into the OpenHands CI/CD pipeline (and potentially as a pre-commit hook) that analyzes both the English instructions and the Python code simultaneously.
The ideal feature would use a dual-engine pipeline (NL Semantic Analyzer + AST Syntax Analyzer) to track variable flows between the prompt instructions and the python code sinks. If a prompt tricks the code into giving away API keys, the pipeline should fail and flag the specific lines causing the leak.
Alternatives Considered
SKILL.md), so they completely miss these leaks.Priority / Severity
High - Significant impact on productivity
Estimated Scope
Medium - New feature with moderate complexity
Feature Area
Agent / AI behavior
Technical Implementation Ideas (Optional)
We could implement a custom GitHub Action or CI step that parses the AST of the Python skills and correlates it with the semantic intents of the Markdown files.
I am very familiar with how to build this. In fact, I have built a standalone open-source project that does exactly this called Scankii.
Instead of just dropping a link, I would love to volunteer to build and integrate this feature natively into the OpenHands pipeline. We could adapt the logic I've already written in Scankii to perfectly fit OpenHands' skill architecture and CI/CD needs.
If the maintainers agree this is a valuable feature, I can submit a Pull Request to get it started!
Additional Context