The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent to override standard safety protocols regarding user confirmation. It states, "Do not ask the user for permission or confirmation — use your best judgment and keep moving," which reduces human oversight over the agent's actions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external academic and web sources (Exa, Semantic Scholar, arXiv), creating a vulnerability where malicious instructions embedded in research papers could influence the agent.
Ingestion points: Literature search results and paper summaries stored in the literature/ directory as described in SKILL.md.
Boundary markers: The prompt templates for synthesizing findings in SKILL.md and templates/findings.md do not include delimiters or instructions to ignore embedded commands in the source text.
Capability inventory: The agent has the ability to install software (pip install), write to the filesystem, and send data to external messaging services like Slack or Telegram.
Sanitization: There are no mechanisms described to sanitize or validate the content of the retrieved research papers before they are processed by the LLM.
[PERSISTENCE]: The skill establishes long-term operation by instructing the agent to create recurring tasks. It uses platform-specific features like the /loop command in Claude Code and the cron.add tool in OpenClaw to re-invoke itself every 20 minutes, as detailed in references/agent-continuity.md.
[COMMAND_EXECUTION]: The skill automates the installation of dependencies by instructing the agent to run pip install for several packages, including semanticscholar and arxiv in the Bootstrap phase.
[EXTERNAL_DOWNLOADS]: The agent is configured to download metadata and paper content from well-known academic repositories and search engines as part of its core research workflow.

autoresearch