The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and "adopt mechanics (metric, commands, scopes, budgets, logging) verbatim" from a program.md file located within the target repository. This creates a significant surface for indirect prompt injection where a malicious repository could dictate the shell commands the agent executes.
Ingestion points: program.md in the target repository; run.log created by the experiment command; results.tsv and /tmp/autoresearch-...md ledger files.
Boundary markers: None. The skill is explicitly instructed to adopt repo-provided configurations verbatim.
Capability inventory: Shell command execution (experiment command, extraction command), Git operations (git -C <repo>), and file system writes.
Sanitization: None. The skill relies on the AI to follow instructions without sanitizing the inputs from the repo or the log files.
[COMMAND_EXECUTION]: The skill executes arbitrary shell commands provided either as user input or extracted from the repository's configuration. This includes the primary experiment command and the metric extraction command.
[DYNAMIC_EXECUTION]: The skill orchestrates a loop where subagents generate code changes which are then automatically committed and executed. While the orchestrator tries to verify these changes against a "frozen scope," the automated execution of LLM-generated code in a shell environment is a high-capability risk.
[INDIRECT_PROMPT_INJECTION]: The skill maintains a ledger and a narrative progress file that include descriptions and "suggested next experiments" generated by LLM subagents. Because these files are read back by the orchestrator and subsequent subagents to guide the loop, a subagent could theoretically inject instructions to manipulate future iterations of the research.

autoresearch