wandb-autoresearch

Warn

Audited by Socket on Aug 6, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/autoresearch_state_impl.py

The module is best characterized as a legitimate-but-risky “state sync” tool that intentionally moves data to and from an external service (W&B). The ‘save’ command can upload arbitrary local files/directories specified by the user to W&B (data exfiltration risk depending on what is passed as --path). The ‘load’ command downloads remote artifacts and writes them into a local directory specified by the user (integrity/supply-chain risk depending on artifact trust). There is no clear evidence of stealthy malware/backdoors in the provided snippet, but the snippet is incomplete/truncated, reducing certainty about full behavior.

Confidence: 60%Severity: 58%
Audit Metadata
Analyzed At
Aug 6, 2026, 06:08 AM
Package URL
pkg:socket/skills-sh/wandb%2Fskills%2Fwandb-autoresearch%2F@39ec75880b13d7d3921093e77326a3441b7cecaacb5954265ff02fcaaabb3289
Security Audit — socket — wandb-autoresearch