loop
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill utilizes a scheduling tool (CronCreate) to establish recurring autonomous task execution. This enables the agent to perform actions such as code modification, git commits, and script execution at set intervals for up to three days without manual intervention.
- [COMMAND_EXECUTION]: The agent is instructed to run shell commands, including git operations and Python scripts, using interpolated variables ({domain}, {name}, {target}). This interpolation from user-provided or file-sourced data creates a surface for potential command injection.
- [DYNAMIC_EXECUTION]: The skill employs a pattern where the agent modifies a target source file and subsequently executes an evaluation script. This dynamic code modification and execution loop is the core mechanism for the autonomous experiments.
- [INDIRECT_PROMPT_INJECTION]: The skill's operational strategy and constraints are read from local files (config.cfg, program.md) and processed by the agent to guide its next actions.
- Ingestion points: Step 3 instructions require the agent to read multiple configuration and strategy files from the .autoresearch/ directory.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the contents of these files as data rather than instructions.
- Capability inventory: The skill provides access to filesystem writes, git repository management, and local script execution.
- Sanitization: The skill does not define validation or sanitization steps for the data retrieved from external configuration files before it influences the agent's logic.
Audit Metadata