run
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads strategy constraints and experiment history to decide which code changes to make and how to update its own instructions. This provides a surface for malicious content within those files to influence the agent's decisions.
- Ingestion points: Step 2 and Step 3 in SKILL.md read .autoresearch/{domain}/{name}/program.md and results.tsv.
- Boundary markers: None present; the skill lacks delimiters or warnings to ignore instructions within the ingested data.
- Capability inventory: File modification in Step 4/7, Git operations in Step 2/5, and Python script execution in Step 1/5.
- Sanitization: No evidence of content sanitization or validation before processing or re-writing.
- [COMMAND_EXECUTION]: The skill performs shell operations including git actions and script execution. The interpolation of {domain} and {name} variables directly into file paths (e.g., cat .autoresearch/{domain}/{name}/config.cfg) and script arguments poses a risk of path traversal if these inputs are not strictly validated.
Audit Metadata