The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/autoresearch.py script executes arbitrary commands using shell=True for the --measure and --checks functions. This allows the agent to execute any system command as part of the research loop.
[DYNAMIC_EXECUTION]: The controller script features a 'hooks' mechanism that automatically executes any executable files found in the .autoresearch/hooks/ directory during the trial process.
[PROMPT_INJECTION]: The WORKER_PROMPT used for autonomous relay runs contains directives that instruct the agent to bypass human oversight, stating "No human is watching, so decide for yourself and never ask questions." This is designed to override standard safety guardrails and confirmation steps.
[PRIVILEGE_ESCALATION]: Documentation in references/harnesses.md explicitly instructs the agent and user to use flags such as --dangerously-skip-permissions and --dangerously-bypass-approvals-and-sandbox to disable host environment security controls and sandboxing.
[INDIRECT_PROMPT_INJECTION]: The autonomous worker prompt in scripts/autoresearch.py is constructed by interpolating data from program.md, ideas.md, and the session log without sanitization. This creates a surface where malicious code or data inside the repository could influence the instructions given to the agent in subsequent iterations.
Ingestion points: Data is read from .autoresearch/program.md, .autoresearch/ideas.md, and log.jsonl to build the WORKER_PROMPT for the sub-agent.
Boundary markers: Absent; project content is directly embedded into the text prompt template.
Capability inventory: The script executes shell commands via subprocess.run, performs git operations, and writes files to the repository.
Sanitization: There is no escaping or validation of the strings interpolated into the sub-agent prompt.

agent-autoresearch