autoresearch-loop

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The provided arl.mjs script uses node:child_process to execute shell commands, including bash for running trial harnesses (measure.sh) and guardrail checks (checks.sh), and git for committing wins or reverting regressions. These actions are the core intended functionality of the skill and are localized to the current working directory.
  • [DATA_EXFILTRATION]: No exfiltration patterns or unauthorized network calls were identified. The CLI tool and associated adapters operate exclusively on local files and do not transmit data to external servers.
  • [SAFE]: The skill incorporates significant security and reliability best practices for autonomous optimization:
  • Independent Oracles: It mandates the use of correctness checks that the optimizer cannot modify, preventing the agent from 'winning' by breaking the code.
  • Goodhart's Law Mitigations: The documentation specifically identifies risks where the agent might game a metric and provides 'Phase 3' instructions for a critic to detect and revert such behavior.
  • Noise Management: It uses Median Absolute Deviation (MAD) confidence scoring to distinguish real improvements from statistical noise before allowing a change to be kept.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 10:14 AM
Security Audit — agent-trust-hub — autoresearch-loop