autoresearch
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The utility
scripts/common.pydefines arun_shell_commandfunction that utilizessubprocess.runwithshell=Trueto execute commands. This is used byscripts/run_experiment.pyto run benchmark and check scripts (e.g.,autoresearch.sh). While the use ofshell=Truewith dynamic strings is generally a security risk, it is the intended core functionality of this skill for orchestrating developer-defined benchmarks within a local environment. - [COMMAND_EXECUTION]: The skill invokes local
gitbinaries viasubprocess.runinscripts/common.pyto perform repository status checks and retrieve commit hashes. These are standard development operations and do not pose a security threat.
Audit Metadata