autoresearch
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and analyzes local files from the repository (
IN_SCOPE_FILES) without using isolation or boundary markers, making it susceptible to instructions hidden in the code being researched.\n - Ingestion points: Files identified in Phase 1.3 are read and interpreted by the agent during Phase 2 and Phase 3.\n
- Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions embedded within the processed data.\n
- Capability inventory: The skill allows modification of files, git operations, and execution of arbitrary shell commands via
METRIC_COMMAND.\n - Sanitization: There is no evidence of sanitization or escaping of file content before analysis.\n- [COMMAND_EXECUTION]: The skill executes shell commands provided by the user (
METRIC_COMMAND) to measure experimental results. While this is core functionality, it relies on arbitrary execution in the terminal.\n- [DYNAMIC_EXECUTION]: The skill operates by autonomously generating new code hypotheses and executing them. This cycle of runtime modification and execution of code is a form of dynamic execution.\n- [PROMPT_INJECTION]: Rule 6 ("DO run autonomously once the loop starts -- never pause to ask 'should I continue?'") explicitly instructs the agent to bypass standard human-in-the-loop safety checkpoints during the experimentation phase.
Audit Metadata