The Agent Skills Directory

[PROMPT_INJECTION]: The instructions explicitly grant the agent high autonomy and override typical interactive safety protocols by directing it to skip user confirmation.
Evidence: "You are the researcher. Do not pause to ask for permission once the loop is running."
Evidence: "This loop runs forever until the human interrupts it — do not pause to ask 'should I continue?' or 'is this a good stopping point?'."
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it bases its future actions on potentially untrusted data gathered during the loop.
Ingestion points: The agent reads execution logs (<run_log>), the results ledger (results.tsv), and the approach registry (approaches.md) to decide the next code modification.
Boundary markers: There are no delimiters or warnings to ignore malicious instructions that might be present in the logs or project files.
Capability inventory: The agent has full write access to project files and the ability to execute shell commands.
Sanitization: No sanitization is performed on the data read from logs or registry files before it influences the agent's logic.
[COMMAND_EXECUTION]: The skill uses several powerful shell commands to manage the environment and execute code.
Evidence: Uses git checkout, git commit, and git reset for state management.
Evidence: Employs a timeout script to execute the research loop and redirects all output to log files.
[REMOTE_CODE_EXECUTION]: The skill performs dynamic code generation and execution, which is a major security risk in an autonomous loop.
Evidence: The agent is instructed to modify files in <editable_files> (such as model.py or training scripts) and then immediately run them using the <run_cmd>. This autonomous write-then-execute pattern allows for the execution of arbitrary code if the agent's planning phase is subverted.

exploratory-autoresearch