autoresearch

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes and analyzes local files from the repository (IN_SCOPE_FILES) without using isolation or boundary markers, making it susceptible to instructions hidden in the code being researched.\n
  • Ingestion points: Files identified in Phase 1.3 are read and interpreted by the agent during Phase 2 and Phase 3.\n
  • Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions embedded within the processed data.\n
  • Capability inventory: The skill allows modification of files, git operations, and execution of arbitrary shell commands via METRIC_COMMAND.\n
  • Sanitization: There is no evidence of sanitization or escaping of file content before analysis.\n- [COMMAND_EXECUTION]: The skill executes shell commands provided by the user (METRIC_COMMAND) to measure experimental results. While this is core functionality, it relies on arbitrary execution in the terminal.\n- [DYNAMIC_EXECUTION]: The skill operates by autonomously generating new code hypotheses and executing them. This cycle of runtime modification and execution of code is a form of dynamic execution.\n- [PROMPT_INJECTION]: Rule 6 ("DO run autonomously once the loop starts -- never pause to ask 'should I continue?'") explicitly instructs the agent to bypass standard human-in-the-loop safety checkpoints during the experimentation phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:07 AM
Security Audit — agent-trust-hub — autoresearch