autoresearch-finalize
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several git commands including
git rev-parse,git merge-base,git checkout, andgit committo manage repository state and branch creation. - [DYNAMIC_EXECUTION]: The
finalize.shscript utilizes thenode -ecommand to execute an inline JavaScript snippet that parses thegroups.jsonfile and extracts configuration parameters. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from files such as
.auto/log.jsonland.auto/prompt.mdto identify which experiments to finalize. * Ingestion points: Instructions inSKILL.mdfor reading experimental logs and research context files from the.autodirectory. * Boundary markers: Not present. * Capability inventory: Repository modification via git, bash script execution, and file system access. * Sanitization: Not present.
Audit Metadata