autoresearch

SUSPICIOUS: the skill’s autonomous experiment-loop behavior matches its stated purpose, but its footprint relies on a third-party Pi package that Pi documents as having full system access. No clear credential harvesting or exfiltration is shown, so this is not confirmed malware, but it carries elevated supply-chain and autonomous-execution risk relative to a simple benchmarking helper.