resume
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates user-supplied variables ({domain}, {name}) directly into shell commands such as 'git checkout' and 'cat'. This dynamic command construction creates a surface for potential command injection or directory traversal if the inputs are not properly validated or sanitized before execution.- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external files like 'config.cfg', 'program.md', and 'results.tsv' to summarize the experiment state. This poses a risk where malicious instructions embedded in these files could influence the agent's behavior.
- Ingestion points: .autoresearch/{domain}/{name}/config.cfg, .autoresearch/{domain}/{name}/program.md, .autoresearch/{domain}/{name}/results.tsv
- Boundary markers: None present in the instructions to separate data from commands.
- Capability inventory: Shell command execution (git, cat, python subprocess calls) and state handover to subsequent commands (/ar:run, /ar:loop).
- Sanitization: No sanitization or validation of the ingested file content is specified.
Audit Metadata