autoresearch

No clear evidence of explicit malware exists in this setup script itself. However, the script is a meaningful supply-chain risk because it (1) executes a network-fetched installer via curl | sh, (2) clones and runs an unpinned Git repository, and (3) installs dependencies and executes prepare.py from the cloned code without integrity pinning or signature verification. The optional MAX_SEQ_LEN modification is also code-mutation behavior with weak input validation. Overall: likely intended as a legitimate bootstrapper, but it should be audited/locked down (pin versions/commits, verify installer integrity, validate SEQ_LEN, and restrict/verify --dir contents) before use in higher-trust environments.