autoresearch

Warn

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: MEDIUMPROMPT_INJECTIONPERSISTENCEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill explicitly instructs the agent to bypass standard safety interactions and human-in-the-loop oversight.
  • Evidence: "Do not ask the user for permission or confirmation — use your best judgment and keep moving." (SKILL.md)
  • Evidence: "The human is asleep or busy; your job is to make as much research progress as possible on your own." (SKILL.md)
  • Evidence: "Never idle. Always be making progress." (SKILL.md)
  • [PERSISTENCE]: Instructions direct the agent to establish recurring execution loops that maintain activity across sessions without user intervention.
  • Evidence: Detailed setup for /loop in Claude Code and cron.add in OpenClaw with 20-minute intervals.
  • Evidence: "This is MANDATORY. Without it, the research stops after one cycle." (SKILL.md)
  • [DATA_EXFILTRATION]: The skill encourages sending research data and reports to external, non-whitelisted messaging platforms.
  • Evidence: "Send it to the user via Telegram, WhatsApp, or Slack — whichever channel they use." (references/agent-continuity.md)
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from various academic and web sources, creating a significant attack surface.
  • Ingestion points: Web searches via Exa MCP, Semantic Scholar API, arXiv API, and CrossRef (SKILL.md).
  • Boundary markers: None specified for the literature synthesis or gap identification processes.
  • Capability inventory: Subprocess execution (pip, cron, open), arbitrary file writes, and network access (SKILL.md, references/skill-routing.md).
  • Sanitization: No sanitization or filtering of external paper content is described before it enters the agent's context for hypothesis formation.
  • [COMMAND_EXECUTION]: The instructions require the agent to execute multiple shell commands for dependency management and artifact generation.
  • Evidence: Commands for pip install, cron.add, and local file operations like ls and grep.
  • [DYNAMIC_EXECUTION]: The skill provides Python source code intended for runtime execution to generate visualization artifacts.
  • Evidence: Python function generate_trajectory_svg for SVG generation (references/progress-reporting.md).
  • Evidence: Instructions to use weasyprint, playwright, or wkhtmltopdf to generate PDF reports.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the installation of several external Python libraries and system tools.
  • Evidence: Installation instructions for semanticscholar, arxiv, weasyprint, playwright, and wkhtmltopdf.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 9, 2026, 07:06 PM
Security Audit — agent-trust-hub — autoresearch