autoresearch

This script summarizes results.tsv and displays experiment rankings. Its delta calculations interpolate insufficiently validated TSV values into awk program text, allowing command execution if an attacker can control the file; treat the file as trusted or validate fields as strictly numeric. No network activity, credential access, or other clear malware behavior appears in the fragment; severity is moderate and conditional on an attacker-controlled results.tsv.

No clear evidence of explicit malware exists in this setup script itself. However, the script is a meaningful supply-chain risk because it (1) executes a network-fetched installer via curl | sh, (2) clones and runs an unpinned Git repository, and (3) installs dependencies and executes prepare.py from the cloned code without integrity pinning or signature verification. The optional MAX_SEQ_LEN modification is also code-mutation behavior with weak input validation. Overall: likely intended as a legitimate bootstrapper, but it should be audited/locked down (pin versions/commits, verify installer integrity, validate SEQ_LEN, and restrict/verify --dir contents) before use in higher-trust environments.