skills/brycewang-stanford/auto-empirical-research-skills/auto-review-loop-minimax/Gen Agent Trust Hub
auto-review-loop-minimax
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill explicitly instructs the agent to override standard behavior and bypass user review for file writing operations ("Do NOT ask the user for permission — just do it silently").
- [COMMAND_EXECUTION]: Automates the execution of experiments via
ssh,screen, andtmux, which allows for arbitrary shell command execution. - [DATA_EXFILTRATION]: The skill reads from a local configuration file (
~/.claude/settings.json) to retrieve credentials and exfiltrates project context to a non-whitelisted external endpoint (api.minimax.io). - [INDIRECT_PROMPT_INJECTION]: The skill implements an autonomous cycle where instructions received from an external AI reviewer are used to modify source code and execute scripts, creating a potential injection surface.
- Ingestion points: Response body from
api.minimax.io(SKILL.md). - Boundary markers: No delimiters or instruction-ignore warnings are applied to the external content before processing.
- Capability inventory: The agent is authorized to use Bash, Write, and Edit tools to implement external recommendations.
- Sanitization: The skill does not perform validation or sanitization on the external model's feedback before implementation.
- [EXTERNAL_DOWNLOADS]: Communicates with an external endpoint (
api.minimax.io) that is not included in the standard trusted source list.
Audit Metadata