The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that promote high autonomy and explicitly direct the agent to skip user confirmation once the research loop has started.
Evidence: The skill states "You are the researcher. Do not pause to ask for permission once the loop is running." and "This loop runs forever until the human interrupts it — do not pause to ask 'should I continue?' or 'is this a good stopping point?'."
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data (scientific literature) which is used to influence code changes and model configuration.
Ingestion points: The skill fetches literature via a sibling tool and reads full-text content (HTML, LaTeX, PDF) from external URLs as described in roles/research-subagent.md.
Boundary markers: No boundary markers or instructions to ignore embedded commands are specified for the external data being processed.
Capability inventory: The skill possesses the ability to execute shell commands, edit project files, and dynamically generate/execute Python scripts.
Sanitization: There is no evidence of sanitization or structural validation for the fetched external text before it is used to motivate implementation changes.
[COMMAND_EXECUTION]: The skill executes shell commands defined in the loop.run.yaml configuration file (e.g., run_cmd and entrypoint) as well as Git commands and timeout scripts.
[REMOTE_CODE_EXECUTION]: The skill dynamically generates and executes Python scripts for model diagnostics during each iteration of the loop.
Evidence: SKILL.md instructs the agent in step 6a to "write the script in iter/analysis/ and run it, redirecting to iter/results/." and indicates that analysis scripts should be drawn from various diagnostic dimensions.

ml-autoresearch