autoresearch

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes build, test, and lint commands (such as cargo build, pytest, or npm test) that are automatically detected or manually configured within the repository's .lab/config.json file.
  • [COMMAND_EXECUTION]: The implementation phase of the research loop invokes the Claude CLI using the --dangerously-skip-permissions flag, which allows for autonomous file modifications and shell execution without per-action user confirmation during an active iteration.
  • [EXTERNAL_DOWNLOADS]: The eval_gen.py script performs an HTTP POST request to the Exa AI API (api.exa.ai) to retrieve adversarial testing pattern suggestions if an EXA_API_KEY is present in the environment.
  • [SAFE]: The skill explicitly strips the ANTHROPIC_API_KEY from its environment before spawning subprocesses for implementation or hypothesis generation, forcing the use of subscription-based authentication and preventing accidental credential leakage.
  • [SAFE]: Experiment knowledge and logs are stored in a decoupled .lab/ directory that is automatically added to the repository's .gitignore file, ensuring that automated git reset --hard operations used for discarding failed experiments do not destroy the research record.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 09:20 AM