This paper attempts to eval OpenHands for prompt injection from skills. Though it seems to me a bit overstated maybe. I think we also have a recent adjustment to tell the LLM that things like AGENTS.md are not to be trusted blindly - for whatever that is worth 😅 https://arxiv.org/abs/2606.16287