autoresearch
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes build, test, and lint commands (such as
cargo build,pytest, ornpm test) that are automatically detected or manually configured within the repository's.lab/config.jsonfile. - [COMMAND_EXECUTION]: The implementation phase of the research loop invokes the Claude CLI using the
--dangerously-skip-permissionsflag, which allows for autonomous file modifications and shell execution without per-action user confirmation during an active iteration. - [EXTERNAL_DOWNLOADS]: The
eval_gen.pyscript performs an HTTP POST request to the Exa AI API (api.exa.ai) to retrieve adversarial testing pattern suggestions if anEXA_API_KEYis present in the environment. - [SAFE]: The skill explicitly strips the
ANTHROPIC_API_KEYfrom its environment before spawning subprocesses for implementation or hypothesis generation, forcing the use of subscription-based authentication and preventing accidental credential leakage. - [SAFE]: Experiment knowledge and logs are stored in a decoupled
.lab/directory that is automatically added to the repository's.gitignorefile, ensuring that automatedgit reset --hardoperations used for discarding failed experiments do not destroy the research record.
Audit Metadata