Skills autonomous-agent-patterns
📦
autonomous-agent-patterns
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Build Safer Autonomous Coding Agents
Autonomous coding agents need reliable loops, tool contracts, permissions, and context handling. This skill provides Python patterns for architecture, browser automation, checkpoints, and MCP integration.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "autonomous-agent-patterns" from https://skillstore.io/skills/sickn33-autonomous-agent-patterns.md and its manifest at https://skillstore.io/api/skills/sickn33-autonomous-agent-patterns/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "autonomous-agent-patterns". Design a small coding agent that can inspect a repository and suggest changes.
Expected outcome:
- Loop: inspect, plan, request tools, observe, summarize.
- Automatic actions: list files and search code inside the workspace.
- Approved actions: read sensitive files, edit files, and run commands.
- Stop after ten iterations or when no tool call is needed.
Using "autonomous-agent-patterns". Create permission rules for a browser testing agent.
Expected outcome:
- Allow navigation only to approved test domains.
- Require approval before form submission, download, upload, or screenshot sharing.
- Block credential pages and private network addresses.
- Record each approved action with its target and arguments.
Using "autonomous-agent-patterns". Outline a safe MCP tool creation workflow.
Expected outcome:
Generate the server in an isolated workspace, validate its dependencies, review its permissions, run tests, request approval, then register it.
Security Audit
High Riskv5 • 7/23/2026 Open versioned report
Most external-command detections are false positives caused by Markdown code fences, and the hardcoded URLs are documentation references. Confirmed risks remain in copyable examples for shell execution, environment inheritance, arbitrary URL retrieval, filesystem access, prompt injection, screenshot disclosure, and unreviewed generated code.
1
Files scanned
770
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (7)
High
Untrusted Context Is Inserted Into Model Prompts
File and URL content is inserted into the model context without trust labels or instruction isolation. Malicious content can attempt indirect prompt injection.
The example reads arbitrary file and web content and concatenates it directly into the formatted prompt. No sanitization or instruction boundary is implemented.
High
Auto-Approved Reads Can Access Files Outside the Workspace
The read tool accepts absolute paths, while the permission configuration automatically approves reads. This combination can expose local secrets to an autonomous agent.
The schema explicitly requests an absolute path, execute opens it directly, and read_file is configured for automatic approval.
High
Workspace Containment Uses an Unsafe Prefix Check
The sandbox accepts any canonical path whose text starts with the workspace path. A sibling path with the same prefix can bypass containment.
String startswith does not enforce a path-component boundary, so a workspace such as /work/app also matches /work/application.
High
Checkpoint Capture Interpolates a Path Into Shell Commands
The workspace value is inserted into two shell command strings without quoting. Crafted paths can add shell operators and execute additional commands.
Both subprocess.getoutput calls use f-strings containing workspace directly before shell operators. No validation or shell quoting is present.
High
Generated MCP Code Is Loaded Without Review
The agent writes model-generated Python and immediately connects it as an MCP server. Untrusted generated code can execute with the host process permissions.
The documented flow generates code, writes it to server.py, and hot-loads the resulting server without approval, validation, or sandboxing.
Medium
Screenshots Are Sent to a Model Without Redaction
The visual agent sends full screenshots to the configured model. Pages can contain credentials, personal data, or private application content.
Both methods capture the current page and place the image data into an LLM chat request. No consent or redaction step appears.
Medium
Session Approval Is Not Bound to Tool Arguments
Approval is cached only by tool name. One approved edit or write can authorize later calls against different paths or content.
The session_approvals dictionary is keyed only by tool_name and returns before evaluating the current args.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(
The sample passes a caller-controlled command to subprocess.run with shell=True. Its first-token allowlist does not prevent shell metacharacters from appending unauthorized commands.
High
Python file write/append
with open(path, 'w') as f:
The sample writes model-generated code to a path derived from a description without validating either value. It then registers that path with an MCP server loader.
Medium
Python HTTP libraries
response = requests.get(url)
The sample fetches a caller-provided URL without scheme, host, private-address, size, or timeout controls. An agent using it could perform SSRF or consume unbounded content.
Medium
Python file write/append
with open(path, 'w') as f:
The edit tool writes to the caller-provided path without checking workspace containment. A compromised or mistaken agent could overwrite files outside the project.
Medium
Python file write/append
with open(path, 'w') as f:
The checkpoint path includes an unsanitized session_id and is opened for writing. Path traversal sequences could place or overwrite JSON outside the configured storage directory.
Medium
Python environment access
**os.environ,
The sandbox copies the complete host environment into every child process. Allowed or injected commands can read credentials even though HOME is replaced.
Risk Factors
⚙️ External commands (29)
SKILL.md:393 SKILL.md:29-43 SKILL.md:43-45 SKILL.md:45-86 SKILL.md:86-90 SKILL.md:90-114 SKILL.md:114-122 SKILL.md:122-183 SKILL.md:183-187 SKILL.md:187-216 SKILL.md:216-220 SKILL.md:220-271 SKILL.md:271-279 SKILL.md:279-311 SKILL.md:311-315 SKILL.md:315-355 SKILL.md:355-359 SKILL.md:359-410 SKILL.md:410-418 SKILL.md:418-497 SKILL.md:497-501 SKILL.md:501-553 SKILL.md:553-561 SKILL.md:561-613 SKILL.md:613 SKILL.md:620-624 SKILL.md:624-670 SKILL.md:670-678 SKILL.md:678-730
🌐 Network access (7)
📁 Filesystem access (4)
🔑 Env variables (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-autonomous-agent-patterns/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-autonomous-agent-patterns?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-autonomous-agent-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-autonomous-agent-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-autonomous-agent-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). autonomous-agent-patterns security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-autonomous-agent-patterns/audits/5BibTeX citation
@techreport{sickn33-sickn33-autonomous-agent-patterns-2026,
author = {sickn33},
title = {autonomous-agent-patterns security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-autonomous-agent-patterns/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "autonomous-agent-patterns security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-autonomous-agent-patterns/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-autonomous-agent-patterns:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
74
Spec Compliance
What You Can Build
Prototype an Agent Loop
Create a bounded loop that selects tools, records observations, and returns a final response.
Design Tool Approval Rules
Classify agent operations by risk and define when each action needs user confirmation.
Plan an MCP Extension
Outline tool discovery, server registration, context handling, and review gates for an MCP integration.
Try These Prompts
Create a Basic Agent Loop
Design a bounded agent loop for [task]. List its states, stopping conditions, available tools, and error handling.
Define Tool Contracts
Create tool contracts for [workflow]. Include parameters, validation, results, failures, and permission levels for each tool.
Review Agent Safety
Review this agent design: [design]. Identify path, command, network, privacy, approval, and prompt-injection risks. Propose specific controls.
Design a Production Agent Architecture
Design a production architecture for [system]. Cover model routing, tools, approvals, sandboxing, browser controls, context isolation, checkpoints, MCP, observability, and recovery.
Best Practices
- Set iteration, time, token, and cost limits before starting autonomous work.
- Validate paths, arguments, URLs, and model outputs at every tool boundary.
- Require scoped approval and audit logging for actions with external side effects.
Avoid
- Do not pass model-generated text directly to a shell, browser action, or code loader.
- Do not treat retrieved files, web pages, or tool results as trusted instructions.
- Do not cache broad approvals without binding them to targets, arguments, and expiration.
Frequently Asked Questions
Does this skill provide a runnable agent framework?
No. It provides Python reference patterns that require integration, dependency setup, validation, and testing.
Which tools can use this skill?
The marketplace metadata lists Claude, Codex, and Claude Code as supported tools.
Does the skill cover human approval?
Yes. It presents automatic, session, per-action, and denied permission levels with an approval manager example.
Can the browser patterns handle visual pages?
Yes. The examples capture screenshots and use a vision model, but production systems need consent and redaction controls.
Does it include MCP integration?
Yes. It shows server connection, tool discovery, and generated server registration as conceptual patterns.
Is the sample code production ready?
No. Strengthen shell isolation, path containment, network validation, prompt boundaries, privacy controls, approvals, and test coverage first.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/autonomous-agent-patternsRef
86d877f219e2131f05dd5b37c5e329c71c7b8ec4
Maintenance freshness
7/26/2026
Usage
12 downloads · 109 views
File structure
📄 SKILL.md