Zouroboros Autoloop

Autonomous optimization loop inspired by Andrej Karpathy's autoresearch: edit, experiment, measure, keep or revert. Best for any task with a numeric metric.

This package is coherent with its stated purpose but is powerful: it will execute arbitrary commands specified in program.md, modify and commit files in the repository (including hard resets), spawn detached processes, and send the target file contents + experiment history to whatever executor CLI you choose (which may transmit them off-host). Before installing or running: 1) review program.md carefully and never point it at repositories with secrets or sensitive data; 2) prefer running autoloop in an isolated/test repository or container; 3) verify/choose an executor you trust (the executor controls where prompts go); 4) run --dry-run first and inspect results.tsv and created branches before letting the loop continue; 5) inspect package source and package-lock for any unexpected dependencies; 6) avoid running as root and back up your repo (or use a disposable clone) because autoloop can commit/revert and runs git reset operations.

Type: OpenClaw Skill Name: zouroboros-autoloop Version: 1.0.0 The bundle implements an autonomous optimization loop that modifies local files and executes arbitrary shell commands (setup, run, and metric extraction) defined in a user-provided 'program.md' file. While this aligns with its stated purpose of 'autoresearch,' the core logic in 'src/autoloop.ts' and 'src/mcp-server.ts' relies on 'execSync' and 'spawn' to run potentially untrusted commands and uses an external LLM 'executor' to generate code changes. This architecture creates a significant risk of Remote Code Execution (RCE) if the configuration or the LLM output is compromised, though no explicit evidence of intentional malice (e.g., data exfiltration or backdoors) was found.