autoresearch
Pass
Audited by Gen Agent Trust Hub on May 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing shell commands for verification and guarding during its autonomous loops. These commands are either provided by the user or auto-detected from the project environment (e.g.,
npm test,pytest). The skill includes a 'Verify-command safety screen' that scans for dangerous patterns such asrm -rf /, fork bombs, and remote execution viacurl | shbefore running any dry-run or verification steps. - [COMMAND_EXECUTION]: In the
learnworkflow, the skill checks for the existence of a specific validation script at$HOME/.claude/scripts/validate-docs.cjsand executes it if present. This is used for mechanical verification of generated documentation. - [SAFE]: The skill implements a 'Safety Posture' that includes mandatory interactive setup gates to collect user context before starting any automated tasks. This ensures the user maintains control over the agent's actions.
- [SAFE]: Data protection measures are integrated, such as a requirement to mask sensitive information (secrets, tokens, PII) in all generated findings and reports, even when the secret itself is part of a security vulnerability.
- [SAFE]: The skill includes an optional interactive prompt to support the project by starring the author's repository using the official GitHub CLI. This action is transparent and requires explicit user consent.
Audit Metadata