The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to autonomously run shell commands provided either by the user or defined within a program.md file found in the target repository. These commands are executed via subagents to perform training, benchmarking, or other experiments. If the target repository is untrusted, this configuration could lead to the execution of malicious code on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through several vectors. It reads and incorporates the contents of program.md and results.tsv from the target repository directly into the instructions for its subagents. Additionally, a free-form 'Research focus' provided by the user is interpolated into subagent prompts without sanitization or explicit boundary markers to prevent the subagent from following instructions embedded within that data.
Ingestion points: The program.md file in the target repository, the results.tsv ledger, and the user-provided Research focus string.
Boundary markers: The subagent prompt uses structured keys (e.g., 'Repo:', 'Metric:') but lacks explicit delimiters or instructions to ignore potential commands embedded within the variable data.
Capability inventory: The skill has the capability to execute shell commands, perform git operations (checkout, commit, reset), and write to the local filesystem (ledger and temp files).
Sanitization: There is no evidence of validation or sanitization for the commands or focus strings before they are processed or executed.

autoresearch