The Agent Skills Directory

[PERSISTENCE]: The skill implements an autonomous background loop via the /ar:loop command. According to skills/status/SKILL.md and SKILL.md, this functionality creates recurring jobs and references 'cron ID', indicating that the skill modifies system schedules (crontab) to maintain execution across sessions.\n- [COMMAND_EXECUTION]: Multiple scripts, including scripts/run_experiment.py, scripts/setup_experiment.py, and several files in the evaluators/ directory, utilize subprocess.run with shell=True. This is used to execute benchmark commands and evaluation logic defined in config.cfg, creating a high-risk surface for shell command injection or arbitrary execution if the configuration is tampered with.\n- [DYNAMIC_EXECUTION]: The experiment runner logic (scripts/run_experiment.py) dynamically invokes the evaluate_cmd specified in the experiment's configuration file. This allows for the execution of arbitrary scripts or binaries during every iteration of the autonomous optimization loop.\n- [INDIRECT_PROMPT_INJECTION]: The skill includes LLM-based evaluation scripts (evaluators/llm_judge_content.py, evaluators/llm_judge_copy.py, evaluators/llm_judge_prompt.py) that ingest untrusted content from target files for quality assessment.\n
Ingestion points: The scripts read the content of files specified as optimization targets (e.g., content/titles.md, posts.md, SKILL.md).\n
Boundary markers: Prompts use basic markdown delimiters (---) to separate instructions from target content but lack robust safety instructions to ignore embedded malicious commands.\n
Capability inventory: The skill has broad capabilities, including executing shell commands via subprocess, writing results to local files, and performing git operations (commit/reset).\n
Sanitization: No sanitization or filtering of the target file content is performed before interpolation into the evaluation prompt.

autoresearch-agent