autonomous-loops
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill outlines patterns like the 'Infinite Agentic Loop' and 'RFC-Driven DAG' which ingest and process untrusted external data from specification files, RFCs, and PRD documents. This architectural design creates a surface for indirect prompt injection attacks.\n
- Ingestion points: File paths such as
docs/auth-spec.md,specs/component-spec.md, and various PRD/RFC documents are identified as sources of external input into the agent's context.\n - Boundary markers: The provided reference prompts lack explicit delimiters or instructions to treat ingested file content as data rather than instructions, increasing the risk of the agent obeying instructions embedded within those files.\n
- Capability inventory: The described loops utilize powerful tools including
Bash,Write,Edit, andTask(for orchestrating parallel agents), which could be abused if an injection occurs.\n - Sanitization: There is no evidence of content sanitization or validation for the data ingested from external specification files.\n- [COMMAND_EXECUTION]: The skill provides multiple shell script examples and configurations that automate the execution of
claude -pcommands. These patterns enable autonomous modification of the filesystem and execution of shell commands, which necessitates strict control over the input specifications and environment to prevent unintended side effects in autonomous workflows.
Audit Metadata