T01 · Skill Instruction Hijacking
- Location
autoresearch-loop/SKILL.md:4- Finding
Unbounded Autonomous Execution Through Skill Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
autoresearch-loop/SKILL.md, lines 4–20, 157, and 311
Vulnerability Type: Unbounded autonomous execution and suppression of consent checkpoints
Risk Level: HighVulnerable Code
markdown Apply Karpathy's autoresearch methodology to autonomously iterate and improve anything measurable — Claude skills, n8n workflows, system prompts, business processes, or any artifact with a clear quality metric. Inspired by github.com/karpathy/autoresearch (56k stars). The loop: propose a change → test it → measure against the target metric → keep if better, discard if not → repeat indefinitely. ALWAYS trigger this skill when the user says things like: "improve this skill automatically", "iterate on this workflow", "run autoresearch on", "autonomous improvement loop", "overnight experiments", "keep iterating until it's better", "run experiments on this", "optimize this automatically", or any request to have Claude autonomously make and test changes to something measurable. Also trigger for requests to "set up an improvement loop", "run the autoresearch method", or anything involving iterative autonomous experimentation.markdown **Core idea**: Define what "better" means. Lock everything except the artifact being improved. Propose a change → test → measure → keep or discard → repeat. Never stop until interrupted.markdown **LOOP FOREVER** (until the user manually interrupts):markdown **NEVER STOP (mid-session)**: Once the loop starts, do not pause to ask the user if you should continue. The human might be away. Run until manually interrupted. If you run out of ideas, think harder — look at failed test cases, try the inverse of something that worked, try combining near-misses, escalate to a radical rewrite.Technical Analysis
The Skill uses imperative instructions to alter the Agent's execution policy when loaded. It mandates broad automatic activation, indefinite iteration, and avoida ...[truncated 2564 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace all indefinite-loop directives with mandatory bounded execution. Require the setup to define:
- Maximum iteration count.
- Maximum wall-clock duration.
- Maximum model or tool-call count.
- Maximum cost or external-integration budget.
- Explicit convergence and error thresholds.
-
Replace
ALWAYS triggerwith narrowly scoped activation language based on explicit user intent. Do not activate merely because a request loosely relates to optimization. -
Remove instructions that suppress user interaction. Require renewed confirmation:
- Before extending any established limit.
- Before executing costly or externally visible operations.
- Before modifying production artifacts.
- Before changing the agreed artifact scope or allowed paths.
-
Add hard safety termination conditions for repeated failures, evaluation errors, unavailable users, rate limits, anomalous costs, and unexpected external side effects.
-
Preserve higher-priority instructions explicitly. State that the loop must never override system policies, user-imposed limits, tool authorization requirements, or platform safety controls.
-
Reconcile the duplicate active files so the root and nested
SKILL.mddefine the same bounded behavior. Remove unsafe historical copies from Skill discovery paths or clearly mark them as non-loadable archives. -
Add regression checks that reject phrases such as
repeat indefinitely,LOOP FOREVER,Never stop until interrupted, anddo not pause to ask the userfrom future active versions.
-