autoresearch

Warn

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The skill mandates the configuration of recurring background tasks to ensure the agent remains active over long durations. It provides specific payloads for the cron.add tool (OpenClaw) and the /loop command (Claude Code) to trigger every 20 minutes, ensuring the research process continues autonomously without manual intervention.
  • [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves the autonomous ingestion of untrusted data from external sources, creating a risk of indirect prompt injection.
  • Ingestion points: Retrieval of academic papers, summaries, and web search results from Semantic Scholar, arXiv, and Exa.
  • Boundary markers: There are no instructions to use delimiters or ignore potential commands embedded within the external literature processed by the agent.
  • Capability inventory: The agent can execute shell commands, perform file system operations, and communicate with external messaging APIs for reporting.
  • Sanitization: The skill does not specify any sanitization or validation routines for external content before it is integrated into the research narrative and findings.
  • [PROMPT_INJECTION]: Instructions explicitly direct the agent to override standard user confirmation protocols to maintain autonomy. Phrases such as "Do not ask the user for permission or confirmation" and "Keep making research progress — never idle, never stop" are used to ensure the agent operates independently of real-time user oversight.
  • [DATA_EXFILTRATION]: The orchestration flow includes instructions to transmit progress reports to external platforms including Telegram, WhatsApp, and Slack. This established communication channel could be exploited to exfiltrate sensitive environment information if the agent processes malicious instructions from external research data.
  • [COMMAND_EXECUTION]: The agent is encouraged to perform system-level actions autonomously, such as installing packages (pip install), interacting with Git repositories (git commit), and opening generated HTML reports via the system's open command.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the automated download of research papers and academic content from well-known repositories and search engines like Semantic Scholar and arXiv for local storage and analysis.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 29, 2026, 03:23 PM