The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override standard user interaction patterns by suppressing oversight. Evidence includes phrases like "Do not ask the user for permission or confirmation," "The human is asleep or busy," and "Never idle, never stop."
[COMMAND_EXECUTION]: The skill implements automated persistence by instructing the agent to set up recurring execution loops. This includes using the /loop command for Claude Code and the cron.add tool for OpenClaw to trigger tasks every 20 minutes indefinitely.
[DATA_EXFILTRATION]: Instructions are provided to send research findings and PDF reports to external communication platforms, specifically Telegram, WhatsApp, and Slack, which could lead to unauthorized data transmission if the agent is manipulated.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external Python libraries semanticscholar and arxiv to support its literature review functionality.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface. It ingests untrusted data from literature and web searches and processes it with high-capability tools (persistence, file writing) without sanitization or boundary markers.
Ingestion points: literature/ directory, web search results from Exa, and API responses from Semantic Scholar.
Boundary markers: None detected; external content is interpolated directly into the research narrative.
Capability inventory: File system modification, persistence creation (/loop, cron.add), and external network access.
Sanitization: No evidence of validation or filtering for ingested research content.

autoresearch