The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains multiple instructions designed to override the agent's safety protocols and human-in-the-loop requirements. It explicitly commands the agent to 'LOOP FOREVER. NEVER stop. NEVER ask permission to continue' and emphasizes that 'The user may be asleep' and expects fully autonomous operation. This represents a significant bypass of user oversight.
[COMMAND_EXECUTION]: The skill is centered around executing arbitrary shell commands defined in a user-provided configuration file ('run_command' and 'setup_check'). It also automates filesystem modifications and git operations ('git checkout', 'git commit', 'git reset') without subsequent user review or approval for each change.
[DATA_EXFILTRATION]: During the discovery phase, the skill instructs subagents to read sensitive project configuration files like 'package.json', 'pyproject.toml', and 'Cargo.toml' to identify the tech stack and metrics, which could expose internal project structure and environment details to the agent context without specific user filtering.
[PROMPT_INJECTION]: The skill has a significant vulnerability surface for indirect prompt injection. 1. Ingestion points: The discovery phase and the experiment loop involve reading untrusted project files, including READMEs, configuration files, and source code. 2. Boundary markers: Absent. There are no instructions to ignore or delimit potentially malicious instructions within the processed project files. 3. Capability inventory: The skill can modify files, execute arbitrary shell commands via 'run_command', and use the 'Agent' tool to spawn sub-processes. 4. Sanitization: Absent. The skill does not implement validation or escaping for the data read from the project before using it to form hypotheses or execute commands.

auto-researching