autoresearch-agent

SUSPICIOUS: the core behavior mostly matches an autoresearch skill, but the install-source mismatch materially weakens trust, and the skill grants an agent broad autonomous edit/execute capability. No clear credential-harvesting or overt exfiltration is shown, but the supply-chain inconsistency and indefinite local automation make this higher risk than a normal documentation skill.

No direct evidence of embedded malware (e.g., exfiltration, backdoors, persistence) or intentional obfuscation is present in this module’s logic. However, it has a critical supply-chain/sandbox-break risk: it executes a shell-interpreted command (shell=True) taken directly from experiment_dir/config.cfg (evaluate_cmd). If config.cfg (or experiment_dir contents) can be influenced by an attacker, this becomes arbitrary command execution in the project directory. The script also performs destructive git resets on failure/timeout, increasing operational impact. Recommend strict validation/whitelisting of evaluate_cmd, avoiding shell=True (use argv lists), and running evaluations in a heavily restricted environment (e.g., container/sandbox) with immutable configs.

No clear evidence of stealthy malware (exfiltration/persistence) is visible in the fragment. However, the code contains a significant and concrete security risk: it executes a user-provided evaluation command with `subprocess.run(..., shell=True)` directly from the CLI argument --eval, enabling arbitrary command execution. Optional evaluator copying and branch creation further expand supply-chain/code-introduction risk, but their safety cannot be confirmed from this snippet.