autoresearch

Pass

Audited by Gen Agent Trust Hub on May 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands for verification and guarding during its autonomous loops. These commands are either provided by the user or auto-detected from the project environment (e.g., npm test, pytest). The skill includes a 'Verify-command safety screen' that scans for dangerous patterns such as rm -rf /, fork bombs, and remote execution via curl | sh before running any dry-run or verification steps.
  • [COMMAND_EXECUTION]: In the learn workflow, the skill checks for the existence of a specific validation script at $HOME/.claude/scripts/validate-docs.cjs and executes it if present. This is used for mechanical verification of generated documentation.
  • [SAFE]: The skill implements a 'Safety Posture' that includes mandatory interactive setup gates to collect user context before starting any automated tasks. This ensures the user maintains control over the agent's actions.
  • [SAFE]: Data protection measures are integrated, such as a requirement to mask sensitive information (secrets, tokens, PII) in all generated findings and reports, even when the secret itself is part of a security vulnerability.
  • [SAFE]: The skill includes an optional interactive prompt to support the project by starring the author's repository using the official GitHub CLI. This action is transparent and requires explicit user consent.
Audit Metadata
Risk Level
SAFE
Analyzed
May 23, 2026, 05:16 AM
Security Audit — agent-trust-hub — autoresearch