autoresearch

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The README includes an explicit instruction flag (--dangerously-skip-permissions) and a packaged prompt that tells an agent to bypass permission checks and "continue iterating autonomously," which is a directive to override safety/permission constraints outside the skill's stated documentation of normal use.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub repo (karpathy/autoresearch) is a known, public project and not inherently suspicious, but the instruction to curl and pipe https://astral.sh/uv/install.sh to sh is high-risk because it downloads and executes a remote shell script from a third-party domain without verification.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs users to fetch and execute remote installation code (curl -LsSf https://astral.sh/uv/install.sh | sh) and to clone a remote repository whose code (https://github.com/karpathy/autoresearch.git / https://github.com/karpathy/autoresearch) will be run by the agent, so these URLs deliver code that is executed and required for the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs running the agent with a "--dangerously-skip-permissions" flag (bypassing permission checks) and also includes a "curl ... | sh" installer step, which together encourage bypassing security mechanisms and running arbitrary remote code on the host.