autoresearch
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The core functionality of the skill involves the agent modifying the source code of
train.py(architectural and logic changes) and then executing that code usinguv run. This creates an autonomous loop of self-modification and execution. - [PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's standard interactive safety constraints. It commands the agent to 'NEVER STOP' and 'Do NOT ask "should I continue?"' once the loop starts, facilitating unattended operation while bypassing human oversight.
- [INDIRECT_PROMPT_INJECTION]: The agent ingests and follows instructions from
program.mdto guide its research efforts. This file represents a vulnerability surface where malicious instructions could be embedded by an external party to influence the agent's autonomous behavior. - Ingestion points:
program.md(read as directions for research iterations). - Boundary markers: No markers or delimiters are specified to isolate instructions from the experiment logic.
- Capability inventory: Source code modification (
train.py), command execution (uv,git,bash), and indefinite looping capabilities. - Sanitization: No sanitization or validation of the input from
program.mdis required or performed. - [COMMAND_EXECUTION]: The skill makes extensive use of system commands including
gitfor version control management,uvfor environment and script execution, and standard Unix utilities (grep,tail,ls,echo) to monitor experiment status and logs.
Audit Metadata