The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override the agent's standard behavioral constraints regarding human oversight.
Evidence: "There is no human in the loop: you frame the problem, run the loop, judge when it's done, and finalize. Never ask 'should I continue?'."
Impact: This suppresses the agent's safety mechanism of requesting user confirmation before performing potentially impactful actions.
[COMMAND_EXECUTION]: The skill requires the agent to create and then execute arbitrary shell scripts.
Evidence: The agent is instructed to "Write the measurement contract: a measure recipe in a justfile, or .auto/measure.sh" and then run it via the autoresearch run command which executes these files.
Impact: While the scripts are generated by the agent, the logic within them is derived from "reading the source deeply." This creates a path where malicious content in the codebase could influence the generated scripts, leading to insecure command execution.
[DATA_EXPOSURE]: The agent is instructed to scan the entire source tree to "understand the workload."
Evidence: "Read the source deeply. Understand the workload before changing anything."
Impact: Provides the agent with broad read access to the local environment, which is necessary for the skill's function but increases the impact if the agent's behavior is subverted.

autoresearch