The Agent Skills Directory

[COMMAND_EXECUTION]: The primary execution scripts, run_experiment.py and setup_experiment.py, use subprocess.run(shell=True) to execute the evaluate_cmd. This command is often constructed from user input or agent-modified configuration, creating a direct path for shell injection.
[COMMAND_EXECUTION]: Multiple evaluator scripts, including benchmark_speed.py, benchmark_size.py, build_speed.py, memory_usage.py, and test_pass_rate.py, utilize subprocess.run with shell=True to perform build and measurement tasks. This implementation pattern significantly increases the skill's attack surface.
[REMOTE_CODE_EXECUTION]: The core logic of the skill involves the agent making autonomous edits to a target file and then executing a command that likely runs that modified code. This unsupervised write-then-execute loop allows for arbitrary code execution in the local environment.
[DATA_EXFILTRATION]: The 'LLM Judge' evaluators (llm_judge_content.py, llm_judge_copy.py, llm_judge_prompt.py) read the content of the target file and send it as a prompt to external CLI tools like claude, codex, or gemini. This results in the transmission of local file content to external service providers.
[PROMPT_INJECTION]: The autonomous loop is governed by instructions read from results.tsv and program.md. An attacker or a malicious evaluation output could inject instructions into these files (Indirect Prompt Injection), potentially causing the agent to deviate from its optimization goal or perform harmful actions during subsequent iterations.
[COMMAND_EXECUTION]: The /ar:loop command implements persistent execution by using CronCreate to schedule the agent's optimization tasks. This persistent autonomy, combined with the ability to modify and execute code, represents a high-risk capability.

autoresearch-agent