The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs multiple autonomous shell operations including 'git checkout', 'git add', and 'git commit'. It also executes a Python script located at '{skill_path}/scripts/run_experiment.py' with arguments derived from user input and configuration files.- [COMMAND_EXECUTION]: The agent is instructed to read an 'evaluate_cmd' from a local configuration file ('.autoresearch/{domain}/{name}/config.cfg'). This configuration-driven approach allows for arbitrary command execution controlled by the contents of a file, which could be exploited if the file is modified by an untrusted source.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from external files to determine its logic. Specifically, it reviews 'results.tsv' and 'program.md' to decide which file changes to make and which strategies to escalate. An attacker who can influence these data files could redirect the agent's autonomous behavior. Evidence Chain: 1. Ingestion points: '.autoresearch/{domain}/{name}/config.cfg', 'program.md', 'results.tsv'. 2. Boundary markers: Absent. 3. Capability inventory: Git command execution, Python script execution, Cron job scheduling (CronCreate/CronDelete), and file system modification. 4. Sanitization: Absent.- [COMMAND_EXECUTION]: The skill uses a scheduling tool ('CronCreate') to establish persistence for its autonomous actions. While it mentions a 3-day expiry, it creates a recurring execution environment where the agent repeatedly modifies files and executes code without direct user intervention for each iteration.

loop