unattended-agent-runs
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill includes detailed configuration examples and instructions for establishing persistence through systemd user units (Linux), launchd agents (macOS), and Task Scheduler (Windows). While intended for legitimate automation of agent runs, these mechanisms allow the agent to remain active and restart automatically across sessions.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow for agents to ingest and act upon untrusted data from external sources such as email inboxes, task queues, or issue pools without direct human supervision.
- Ingestion points: Untrusted data enters the agent's context through external sources like inboxes or task queues (documented in
SKILL.md). - Boundary markers: The instructions mandate a "full-prompt gate" requiring the agent to record each page read, which helps ensure all instructions are processed but does not prevent malicious content within those instructions.
- Capability inventory: The agent is authorized to perform external actions like sending messages and modifying files based on local policy files (documented in
SKILL.mdandreferences/checkpoint-schema.md). - Sanitization: The framework relies on external written authorization policies (e.g., AGENTS.md) rather than technical input sanitization or filtering to mitigate malicious payloads in the ingested data.
- [EXTERNAL_DOWNLOADS]: The skill references an "autonomy kit" repository on GitHub (
github.com/jamditis/claude-skills-journalism) for starter loops and process designs. This repository belongs to the skill's author.
Audit Metadata