The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's typical interaction loop. It commands the agent to 'LOOP FOREVER', 'Never ask "should I continue?"', and 'NEVER STOP', explicitly telling the agent to work indefinitely even if the user is not present or until manually interrupted. This suppresses the human-in-the-loop safety pattern.
[DYNAMIC_EXECUTION]: The assets/prepare.py script uses pickle.load() and pickle.dump() to handle the BPE tokenizer state. Python's pickle module is vulnerable to unsafe deserialization if an attacker replaces the tokenizer.pkl file in the predictable ~/.cache/autoresearch/ directory with a malicious payload.
[COMMAND_EXECUTION]: The skill relies heavily on the agent executing complex shell command sequences. This includes creating and running benchmark scripts (autoresearch.sh), managing experiment state with git commands (commit, branch, revert), and using uv and python for runtime operations.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests untrusted data from the run.log and autoresearch.jsonl files.
Ingestion points: The agent parses metrics and stack traces from run.log using grep and tail, and processes experimental history from autoresearch.jsonl using a Python-based parser in session-status.sh.
Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are used when reading these log files.
Capability inventory: The agent has capabilities to write files, execute shell scripts, perform network downloads, and manage git repositories.
Sanitization: While log-experiment.sh includes a json_escape function for writing logs, the parsing logic for incoming data (like experiment results and crash logs) lacks rigorous validation, potentially allowing malformed output to influence agent behavior.
[EXTERNAL_DOWNLOADS]: The skill fetches data shards from a well-known service (huggingface.co) and recommends installing the uv package manager from its official source. It also configures a custom PyTorch index at download.pytorch.org for GPU-specific wheels. These references to well-known infrastructure are documented for transparency.

autoresearch-ml