The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation process directs users to clone and run code from a repository hosted by an unverified GitHub user (github.com/leo-lilinxiao/codex-autoresearch), which then controls the autonomous modification and execution loop.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands and scripts (e.g., Bash, Python, Node.js) as part of its 'Verify' and 'Guard' gates. These commands are either inferred by the agent or provided by the user, creating a vector for executing malicious code.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it autonomously ingests data and uses it to perform privileged operations.
Ingestion points: The skill scans the entire project codebase (Phase 0), reads lessons from '.agents/skills/codex-autoresearch/lessons.md', and fetches data from external web searches when stuck.
Boundary markers: There are no explicit markers or instructions to delimit ingested data or prevent the agent from following embedded instructions within that data.
Capability inventory: The skill, defined in 'SKILL.md', executes shell commands for verification, performs git commits and reverts, and writes lesson and log files to the file system.
Sanitization: The skill lacks documented validation or sanitization mechanisms for content retrieved from the codebase or the internet before it influences the agent's behavior.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes verification commands based on the inferred repo state and user goals, which involves assembling strings into executable commands.
[EXTERNAL_DOWNLOADS]: The skill requires downloading its core logic from an external, unverified source during the setup process.

codex-autoresearch-loop