loop
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands including
git(checkout, add, commit) andpythonto run experiment evaluation scripts. It also manages persistence viaCronCreateandCronDeletecalls to schedule recurring tasks. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface through its autonomous loop.
- Ingestion points: The agent reads state and configuration from
.autoresearch/{domain}/{name}/config.cfg,program.md, andresults.tsvas specified inSKILL.md. - Boundary markers: There are no delimiters or specific instructions to ignore potential malicious directives within the processed files.
- Capability inventory: The skill allows the agent to modify files, execute git/python commands, and schedule persistent tasks.
- Sanitization: No sanitization or verification of the external file content is performed before the agent reviews it to determine future actions.
Audit Metadata