The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's interactive safety protocols and user confirmation requirements.
Evidence: Phrases such as "Never stop. Never ask.", "Once the plan is confirmed, the loop runs autonomously. Never stop. Never ask.", and "Do not stop. Do not ask for confirmation. Keep running experiments until the user interrupts."
Impact: These instructions direct the agent to bypass the human-in-the-loop requirement, which is a core safety mechanism for executing potentially dangerous tools like shell commands.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands in an infinite autonomous loop.
Evidence: The skill asks the user for a "Verify command" and a "Guard command" and then executes these commands repeatedly in Phase 2.
Impact: While the commands are initially provided by the user, the agent's ability to modify project files between executions creates a path for unintended code execution if the agent is manipulated into altering the environment or scripts that the commands rely on.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes untrusted data from the repository to decide its next actions.
Ingestion points: The agent reads "in-scope files" and project history (autoresearch-results.tsv) during the "Review" and "Ideate" steps in SKILL.md.
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are used when the agent processes the repository content.
Capability inventory: The agent has the capability to write files, perform git operations (commit/push/merge), and execute shell commands (verify and guard commands).
Sanitization: No sanitization or validation of the repository content is performed before it is used to inform the agent's "ideation" phase, allowing malicious instructions in the code to potentially influence the autonomous loop.

autoresearch