ar-status
Warn
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs shell commands using placeholders {domain}, {name}, and {file} which are interpolated from user-supplied input. This pattern is susceptible to command injection if the inputs contain shell metacharacters. Evidence: 'python {skill_path}/scripts/log_results.py --experiment {domain}/{name}', 'cat .autoresearch/{domain}/{name}/loop.json', and 'python {skill_path}/scripts/log_results.py --dashboard --format csv --output {file}'.
- [INDIRECT_PROMPT_INJECTION]: The skill reads from local files (.autoresearch/.../loop.json) and incorporates the content into the agent's context. This creates a surface for indirect prompt injection where malicious instructions in the data could influence agent behavior. 1. Ingestion points: .autoresearch/{domain}/{name}/loop.json (SKILL.md). 2. Boundary markers: None present. 3. Capability inventory: Shell command execution via python and cat. 4. Sanitization: No content validation or sanitization of file content is described.
Audit Metadata