run
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands, including
git checkout,git add,git commit, andpython, using parameters derived from external configuration files (config.cfg) and user input. This facilitates local file system operations and code execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files to determine its logic and strategy, creating a surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read experiment configuration (
config.cfg), strategy and constraints (program.md), and experiment history (results.tsv) from the.autoresearch/directory. - Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings for the data being read.
- Capability inventory: The skill possesses the ability to write to target files, perform git commits, and execute local Python scripts (
setup_experiment.py,run_experiment.py). - Sanitization: There is no mention of sanitization, validation, or escaping of the content ingested from the experiment's strategy or history files before it influences the agent's behavior.
Audit Metadata