loop
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill utilizes
CronCreateto schedule recurring autonomous tasks that execute instructions without immediate user oversight. These scheduled jobs persist for up to 3 days. - [COMMAND_EXECUTION]: The autonomous loop involves the execution of system commands, including
git checkout,git add,git commit, andpythonscript invocation within the agent's context. - [DYNAMIC_EXECUTION]: The skill creates a self-modifying execution cycle. The agent is instructed to autonomously edit a target file and then immediately execute a Python-based evaluation script (
run_experiment.py) to test the changes. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface as its recurring behavior is dictated by the contents of files within the workspace.
- Ingestion points: The agent reads strategy, constraints, and evaluation commands from
.autoresearch/{domain}/{name}/config.cfgandprogram.md. - Boundary markers: The instructions do not define clear boundaries or validation steps for the content ingested from these files.
- Capability inventory: The loop has the capability to write files, commit changes to the repository, and execute shell commands.
- Sanitization: There is no evidence of sanitization or integrity checking for the configuration files before they are used to influence the agent's autonomous actions.
Audit Metadata