The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions utilize shell variables {domain} and {name} directly within bash commands such as git checkout and cat. If these variables are derived from untrusted user input, it could lead to command injection vulnerabilities, allowing for the execution of arbitrary shell commands.
[PROMPT_INJECTION]: The skill reads and summarizes content from external files like program.md and results.tsv. These files represent a surface for indirect prompt injection, as malicious instructions embedded within them could influence the agent's output or subsequent actions during the 'Report current state' step.
Ingestion points: .autoresearch/{domain}/{name}/results.tsv, .autoresearch/{domain}/{name}/program.md, and .autoresearch/{domain}/{name}/config.cfg (accessed via cat in SKILL.md).
Boundary markers: None present; data from files is read directly into the execution context without delimiters.
Capability inventory: File system access (cat), Git operations (checkout, log), and execution of local Python scripts.
Sanitization: No evidence of sanitization, validation, or escaping of the content read from external files before it is processed by the agent.

resume