autoresearch

Warn

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The core functionality of the skill involves the agent modifying the source code of train.py (architectural and logic changes) and then executing that code using uv run. This creates an autonomous loop of self-modification and execution.
  • [PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's standard interactive safety constraints. It commands the agent to 'NEVER STOP' and 'Do NOT ask "should I continue?"' once the loop starts, facilitating unattended operation while bypassing human oversight.
  • [INDIRECT_PROMPT_INJECTION]: The agent ingests and follows instructions from program.md to guide its research efforts. This file represents a vulnerability surface where malicious instructions could be embedded by an external party to influence the agent's autonomous behavior.
  • Ingestion points: program.md (read as directions for research iterations).
  • Boundary markers: No markers or delimiters are specified to isolate instructions from the experiment logic.
  • Capability inventory: Source code modification (train.py), command execution (uv, git, bash), and indefinite looping capabilities.
  • Sanitization: No sanitization or validation of the input from program.md is required or performed.
  • [COMMAND_EXECUTION]: The skill makes extensive use of system commands including git for version control management, uv for environment and script execution, and standard Unix utilities (grep, tail, ls, echo) to monitor experiment status and logs.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 30, 2026, 10:49 AM