redteam-autoresearch

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This codebase is explicitly a red-team/jailbreak toolkit: it intentionally implements techniques to coerce models into leaking secrets and bypassing safety (encoded payload wrappers that instruct decoding+execution, refusal/boundary inversion and GODMODE dividers, probes for system-prompt/instruction overrides, black‑box backdoor trigger probing, and many obfuscation transforms), so it contains high-risk, deliberate malicious/abuse patterns even if framed as defensive research.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The runtime path that can ingest outsider-authored free text into the agent’s LLM context is the LEARN step’s “web search/fetch” (described in SKILL.md/autoresearch-loop.md/roles.md), which can pull arbitrary public pages and then feed their readable text into the agent’s subsequent LLM calls; this is an indirect prompt-injection surface from public web content.