loop

Warn

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The skill utilizes CronCreate to schedule recurring autonomous tasks that execute instructions without immediate user oversight. These scheduled jobs persist for up to 3 days.
  • [COMMAND_EXECUTION]: The autonomous loop involves the execution of system commands, including git checkout, git add, git commit, and python script invocation within the agent's context.
  • [DYNAMIC_EXECUTION]: The skill creates a self-modifying execution cycle. The agent is instructed to autonomously edit a target file and then immediately execute a Python-based evaluation script (run_experiment.py) to test the changes.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface as its recurring behavior is dictated by the contents of files within the workspace.
  • Ingestion points: The agent reads strategy, constraints, and evaluation commands from .autoresearch/{domain}/{name}/config.cfg and program.md.
  • Boundary markers: The instructions do not define clear boundaries or validation steps for the content ingested from these files.
  • Capability inventory: The loop has the capability to write files, commit changes to the repository, and execute shell commands.
  • Sanitization: There is no evidence of sanitization or integrity checking for the configuration files before they are used to influence the agent's autonomous actions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 30, 2026, 03:47 AM
Security Audit — agent-trust-hub — loop