The Agent Skills Directory

[COMMAND_EXECUTION]: The skill schedules the execution of shell commands through the CronCreate tool. The instructions include running git checkout, git add, git commit, and a Python script located at {skill_path}/scripts/run_experiment.py. These commands are executed autonomously on a recurring schedule.
[COMMAND_EXECUTION]: User-supplied inputs {domain} and {name} are interpolated directly into shell command strings and file paths. For example, the command python {skill_path}/scripts/run_experiment.py --experiment {domain}/{name} --single uses these variables. If the inputs are not properly sanitized by the underlying agent platform, this pattern could be exploited for command injection or directory traversal.
[INDIRECT_PROMPT_INJECTION]: The skill's autonomous loop relies on reading configuration and strategy from local files such as .autoresearch/{domain}/{name}/config.cfg and .autoresearch/{domain}/{name}/program.md. If an attacker can influence these files (e.g., via a malicious Pull Request), they could provide instructions that the agent would follow during its recurring iterations.
Ingestion points: .autoresearch/{domain}/{name}/config.cfg, .autoresearch/{domain}/{name}/program.md, and .autoresearch/{domain}/{name}/results.tsv in the local repository.
Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore embedded instructions within the project files.
Capability inventory: The agent has capabilities to read/write files, execute shell commands (git and python), and manage scheduled tasks via CronCreate/CronDelete.
Sanitization: No explicit sanitization or validation of the configuration file content is mentioned in the instructions.
[PERSISTENCE]: The skill establishes persistence by using the CronCreate tool to schedule recurring tasks. While the skill mentions a 3-day auto-expiry limit, it still allows for autonomous execution over an extended period without continuous user oversight.

ar-loop