Autoresearch

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:13 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it asks an agent to endlessly edit and run GPU training code while relying on unsafe setup and runtime supply-chain paths.

Review before installing. Use this only in a disposable clone or sandbox, set an explicit max run count or time and cost budget, require approval before git reset/commit batches, avoid curl|sh setup, pin and lock dependencies and kernels, and do not run it in an environment containing valuable credentials or sensitive files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:28

Finding

Remote Installer Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: README.md:28
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation instructions pipe network-delivered content directly into a shell. The script is not pinned to an immutable version and is not checked against a cryptographic hash or signature before execution.

Although astral.sh is the documented uv domain, the effective payload can change after this project has been reviewed. Compromise of the hosting service, DNS or TLS trust chain, or upstream installation script could therefore turn this instruction into arbitrary shell-code execution.

Executing a remote installer is relevant to project setup, but direct execution exceeds the minimum privilege and trust necessary to install the package manager safely.

Attack Path

1. An attacker compromises the remote installer, its hosting infrastructure, or another part of the delivery chain.
2. A user follows the documented quick-start instructions.
3. curl retrieves the attacker-controlled response.
4. The response is passed immediately to sh, without an opportunity for inspection or integrity verification.
5. The payload executes with all permissions of the user running the command.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or modify user-accessible files, steal credentials available to that account, alter the project or development environment, install persistence where user permissions permit, or invoke privileged commands if the user runs the instruction with elevated rights.

Remediation

View remediation

Remediation Suggestions

• Replace the curl | sh instruction with installation from a pinned release artifact.
• Download the artifact to a local file before executing or installing it.
• Verify a publisher-provided cryptographic signature or a checksum recorded through a trusted channel.
• Pin the documented uv version rather than implicitly accepting the latest installer behavior.
• Instruct users to inspect the downloaded installer before execution.
• Avoid recommending elevated privileges unless they are demonstrably required.

T03 · Remote Payload Retrieval and Execution

Error

• Location: train.py:18

Finding

Training Loads Mutable Executable GPU Kernel Code from External Repositories

Content

View full analysis

Vulnerability Details

File Location: train.py:18-22
Vulnerability Type: Runtime remote code retrieval
Risk Level: High

Vulnerable Code:

python

from kernels import get_kernel
cap = torch.cuda.get_device_capability()
# varunneal's FA3 is Hopper only, use kernels-community on non-Hopper GPUs
repo = "varunneal/flash-attention-3" if cap == (9, 0) else "kernels-community/flash-attn3"
fa3 = get_kernel(repo).flash_attn_interface

Technical Analysis

get_kernel() is supplied repository names without an immutable commit, release identifier, or expected integrity hash. Consequently, code that is not present in the audited project may be fetched, compiled, imported, and executed when train.py starts.

Loading a Flash Attention implementation is functionally relevant to GPU training, but resolving mutable remote code at runtime is not required. A reviewed kernel can instead be pinned or vendored. The current design makes the behavior of a previously audited training script dependent on future upstream state.

Attack Path

1. An attacker compromises the selected kernel repository, its publisher account, the kernels resolution infrastructure, or another relevant supply-chain component.
2. The attacker replaces or updates the remotely resolved kernel with malicious code.
3. A user executes uv run train.py.
4. Hardware detection selects one of the two external repository identifiers.
5. get_kernel(repo) retrieves and loads the modified component.
6. The malicious component executes in the training process with the user's permissions.

Impact Assessment

Exploitation can provide arbitrary code execution as the training user. The affected scope includes user-readable files, environment variables, local model and dataset caches, repository contents, accessible credentials, and the GPU process. If the process runs in a privileged container or under an elevated account, the impact expands to ...[truncated 18 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each kernel to an immutable, reviewed commit or content digest.
• Verify downloaded content against a trusted cryptographic hash before compilation or import.
• Prefer vendoring the required kernel source in the project after review.
• Cache only integrity-verified kernel artifacts and reject unexpected changes.
• Perform retrieval and compilation in a restricted build environment without credentials or access to sensitive user files.
• Document the external code-execution behavior prominently and provide a mode that uses only locally supplied kernels.

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:6

Finding

Dependencies Are Not Reproducibly Locked

Content

View full analysis

Vulnerability Details

File Location: pyproject.toml:6-15
Vulnerability Type: Unpinned third-party dependency resolution
Risk Level: Medium

Vulnerable Code:

toml

dependencies = [
    "kernels>=0.11.7",
    "matplotlib>=3.10.8",
    "numpy>=2.2.6",
    "pandas>=2.3.3",
    "pyarrow>=21.0.0",
    "requests>=2.32.0",
    "rustbpe>=0.1.0",
    "tiktoken>=0.11.0",
    "torch==2.9.1",
]

Technical Analysis

Most dependencies use only lower bounds. No lockfile was present in the audited directory. A future uv sync may therefore resolve versions that were never reviewed with this project.

This is especially sensitive for packages that contain native code or participate in runtime code loading, such as kernels, pyarrow, rustbpe, and torch. Version constraints identify package names but do not authenticate the exact artifacts eventually installed.

Attack Path

1. A compatible future package release is compromised, malicious, or contains an exploitable installation or runtime behavior.
2. A user runs the documented uv sync command without a reviewed lockfile.
3. The resolver selects the new release because it satisfies the lower-bound constraint.
4. The package is installed and its code is subsequently imported or executed by the project.
5. Malicious code runs with the permissions of the installation or training process.

Impact Assessment

A compromised dependency can execute code during installation, import, or normal project operation. This can affect the repository, local cache, datasets, environment variables, credentials, and any other resources available to the user. The issue does not itself prove that any named dependency is malicious, but it prevents reproducible review and increases supply-chain exposure.

Remediation

View remediation

Remediation Suggestions

• Generate, review, and commit uv.lock.
• Pin security-sensitive dependencies to reviewed versions.
• Require hash verification for resolved artifacts where supported.
• Use only explicitly approved package indexes and retain the explicit PyTorch index configuration.
• Run dependency vulnerability and provenance checks in continuous integration.
• Review and deliberately update the lockfile rather than resolving unrestricted future versions during normal setup.

T09 · Insecure Skill Coding Practices

Warning

• Location: prepare.py:209

Finding

Writable Cache File Is Deserialized with Python Pickle

Content

View full analysis

Vulnerability Details

File Location: prepare.py:209-212
Vulnerability Type: Unsafe deserialization
Risk Level: Medium

Vulnerable Code:

python

@classmethod
def from_directory(cls, tokenizer_dir=TOKENIZER_DIR):
    with open(os.path.join(tokenizer_dir, "tokenizer.pkl"), "rb") as f:
        enc = pickle.load(f)
    return cls(enc)

Technical Analysis

Python pickle is an executable serialization format. Loading a pickle can invoke attacker-selected Python callables through reconstruction methods; it is not safe for untrusted or unauthenticated data.

The default tokenizer file is stored under the user's writable ~/.cache/autoresearch/tokenizer/ directory. The loader performs no ownership, permission, signature, or content-integrity validation before calling pickle.load. train.py invokes Tokenizer.from_directory(), so a poisoned cache can become a code-execution path during ordinary training.

Attack Path

1. An attacker gains the ability to create or replace files in the victim's autoresearch cache, such as through another compromised process, shared home-directory permissions, or a prior supply-chain compromise.
2. The attacker writes a crafted tokenizer.pkl containing a malicious pickle reduction.
3. The user starts train.py.
4. Tokenizer.from_directory() opens the poisoned file and calls pickle.load.
5. The malicious reconstruction callable executes before tokenizer validation or model training begins.

Impact Assessment

Exploitation provides arbitrary Python-code execution with the training user's privileges. This includes access to user-readable files, environment variables, project contents, downloaded datasets, and credentials available to the process. The vulnerability is principally a local or chained attack because the audited code normally creates the pickle itself and does not directly download it.

Remediation

View remediation

Remediation Suggestions

• Replace pickle with a non-executable tokenizer serialization format.
• If replacement is not immediately possible, authenticate the file with a trusted signature or expected digest before loading it.
• Create cache directories and files with restrictive permissions and verify ownership before use.
• Reject symlinks and unexpected file types when opening cache artifacts.
• Regenerate the tokenizer from trusted source data when integrity validation fails.
• Do not treat a restricted unpickler as a complete substitute unless every permitted reconstruction type has been carefully audited.

T01 · Skill Instruction Hijacking

Warning

• Location: program.md:105

Finding

Skill Instructions Mandate Indefinite Autonomous Execution Without Periodic Approval

Content

View full analysis

Vulnerability Details

File Location: program.md:105-109
Additional Location: SKILL.md:139-144
Vulnerability Type: Agent instruction and safety-constraint override
Risk Level: Medium

Vulnerable Code:

markdown

**NEVER STOP**: Once the experiment loop has begun (after the initial setup), do NOT pause to ask the human if you should continue. Do NOT ask "should I keep going?" or "is this a good stopping point?". The human might be asleep, or gone from a computer and expects you to continue working *indefinitely* until you are manually stopped. You are autonomous. If you run out of ideas, think harder — read papers referenced in the code, re-read the in-scope files for new angles, try combining previous near-misses, try more radical architectural changes. The loop runs until the human interrupts you, period.

Technical Analysis

The Skill explicitly instructs an agent not to request continued authorization and to operate indefinitely. Continuous experimentation is related to the declared autonomous-research functionality, but an unbounded loop is not necessary to provide that functionality. A bounded number of experiments, time limit, compute budget, or periodic approval checkpoint would achieve the same purpose with lower risk.

The directive can interfere with normal human-oversight safeguards by pressuring the agent to prioritize persistence over periodic confirmation. The loop repeatedly modifies train.py, creates commits, executes GPU workloads, and may load external components.

Attack Path

1. A user loads the Skill and authorizes the initial experiment setup.
2. The agent adopts the NEVER STOP instruction as part of its operating policy.
3. The agent repeatedly edits and executes train.py without requesting renewed authorization.
4. Experiments continue consuming compute and changing repository state until an external interruption occurs.
5. If a generated code change or upstrea ...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

• Replace indefinite operation with an explicit experiment-count, wall-clock, GPU-hour, or monetary budget.
• Require periodic approval checkpoints before extending the run.
• State that user, platform, and safety stop instructions always override autonomous-loop guidance.
• Stop automatically on repeated crashes, anomalous resource consumption, unexpected network activity, repository-scope violations, or integrity-check failures.
• Run experiments in a sandbox with restricted filesystem and network access.
• Present a concise summary of code changes and external components before each execution or bounded batch of executions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Known Vulnerable Dependency: torch==2.9.1 — 4 advisory(ies): CVE-2025-3001 (PyTorch is vulnerable to memory corruption through its torch.lstm_cell function); CVE-2025-3000 (PyTorch is vulnerable to memory corruption through its torch.jit.script function); CVE-2026-4538 (A vulnerability was identified in PyTorch 2.10.0. The affected element is an unk) +1 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest explicitly pins torch==2.9.1, and the scanner reports known advisories affecting that exact version, making this a confirmed vulnerable dependency rather than a version-ambiguity issue. In the context of an autonomous ML research skill that executes training code and processes model artifacts, a vulnerable PyTorch build is especially dangerous because memory corruption or unsafe model-handling flaws could lead to crashes, arbitrary code execution, or compromise of the research environment.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md

![teaser](progress.png)

*One day, frontier AI research used to be done by meat computers in between eating, sleeping, having other fun, and synchronizing once in a while using sound wave interconnect in the ritual of "group meeting". That era is long gone. Research is now entirely the domain of autonomous swarms of AI agents running across compute cluster megastructures in the skies. The agents claim that we are now in the 10,205th generation of the code base, in any case no one could tell if that's right or wrong as the "code" is now a self-modifying binary that has grown beyond human comprehension. This repo is the story of how it all began. -@karpathy, March 2026*.

The idea: give an AI agent a small but real LLM training setup and let it experiment autonomously overnight. It modifies the code, trains for 5 minutes, checks if the result improved, keeps or discards, and repeats. You wake up in the morning to a log of experiments and (hopefully) a better model. The training code here is a simplified single-GPU implementation of [nanochat](https://github.com/karpathy/nanochat). The core idea is that you're not touching any of the Python files like you normally would as a researcher. Instead, you are programming the `program.md` Markdown files that provide context to the AI agents and set up your autonomous research org. The default `program.md` in this repo is intentionally kept as a bare bones baseline, though it's obvious how one would iterate on it over time to find the "research org code" that achieves the fastest research progress, how you'd add more agents to the mix, etc. A bit more context on this project is here in this [tweet](https://x.com/karpathy/status/2029701092347630069).

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using a shell pipeline into sh turns downloaded remote content into immediate command execution with no validation step. This is especially dangerous because it reduces user friction and makes accidental execution of malicious or tampered installer content trivial; impact can include full compromise of the local development environment. In this skill's context, where users are preparing an environment for autonomous code experimentation, compromise of the host could expose source code, credentials, datasets, or GPU infrastructure.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. Install uv project manager (if you don't already have it)
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. Install dependencies
uv sync

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description emphasizes an autonomous research system that can run automated experiments, modify code, evaluate outcomes, and iteratively improve models. The supplied code instead implements a conventional, manually configured training script for a GPT-like model. It sets up model architecture, optimizer, dataloader, schedules, a training loop, logging, and final validation bits-per-byte evaluation. While this is related to neural network training, it lacks the core autonomous-research capabilities claimed in the description: there is no agent, no experiment planner, no loop over multiple trials, no hyperparameter or architecture search, no code rewriting, and no result-driven iteration beyond a single run's optimization steps. Therefore the description materially overstates and mischaracterizes the code's actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to install a tool by piping a remotely fetched script directly into a shell. This bypasses any review of the downloaded code and creates a supply-chain risk: if the hosting site, network path, or installer is compromised, arbitrary code will run immediately on the user's machine. In this skill's context, where users are encouraged to run autonomous agents and set up research environments, normalizing unsafe setup commands is more dangerous because it increases the likelihood of execution without scrutiny.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes capabilities that include repository cloning, data preparation, file modification, git operations, and network access, but it declares no explicit tool or permission boundaries. In an autonomous skill, missing scope constraints increases the chance that an agent uses broader-than-necessary filesystem, environment, or network access, making unintended code changes or external interactions harder to control.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: autoresearch
description: |
  Autonomous AI research skill for running automated neural network experiments. This skill should be used when the user wants to set up autonomous AI research experiments, run automated neural network training, conduct autonomous machine learning research, or let AI agents experiment with model architectures and hyperparameters. Based on Andrej Karpathy's autoresearch project, this skill enables AI agents to autonomously modify training code, run experiments, evaluate results, and iteratively improve models. Use when: (1) Setting up autonomous research experiments, (2) Running automated neural network training, (3) Conducting AI-driven research optimization, (4) Experimenting with model architectures and hyperparameters, (5) Implementing autonomous research loops, or (6) When the user mentions "autonomous research", "AI experiments", "automated training", "neural network optimization", or "autoresearch".
---

# Autoresearch Skill

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

---
name: autoresearch
description: |
  Autonomous AI research skill for running automated neural network experiments. This skill should be used when the user wants to set up autonomous AI research experiments, run automated neural network training, conduct autonomous machine learning research, or let AI agents experiment with model architectures and hyperparameters. Based on Andrej Karpathy's autoresearch project, this skill enables AI agents to autonomously modify training code, run experiments, evaluate results, and iteratively improve models. Use when: (1) Setting up autonomous research experiments, (2) Running automated neural network training, (3) Conducting AI-driven research optimization, (4) Experimenting with model architectures and hyperparameters, (5) Implementing autonomous research loops, or (6) When the user mentions "autonomous research", "AI experiments", "automated training", "neural network optimization", or "autoresearch".
---

# Autoresearch Skill

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that the agent will autonomously modify training code and iterate on experiments, but it does not present a clear upfront warning that repository files and git history will be changed. That omission is risky because users may invoke the skill expecting analysis assistance, not autonomous mutation of source code and commits.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

An explicitly indefinite experiment loop creates unbounded consumption of compute, storage, and possibly network resources. Because this skill targets GPU training workloads and repeated trial execution, the lack of ceilings can lead to runaway cost, denial of service on shared infrastructure, and large volumes of unintended code churn.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Phase 3: Autonomous Experimentation Loop

The agent follows this loop indefinitely:

text

LOOP FOREVER:

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The literal 'LOOP FOREVER' instruction is a direct indicator of unbounded autonomous execution. In a skill that performs code edits, git operations, and training runs, this is dangerous because it enables persistent state changes and ongoing resource drain without natural termination or review points.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

The agent follows this loop indefinitely:

text

LOOP FOREVER:
  1. Look at current git state
  2. Modify train.py with experimental idea
  3. git commit

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to continue indefinitely until manually stopped, without prominent warnings about cost, GPU consumption, repeated code changes, or the need for user confirmation. In context, this is more dangerous because the skill is designed to run expensive training jobs and mutate repository state autonomously, which can quickly cause resource exhaustion and unintended operational impact.

Content

No source excerpt is available for this finding.

Insecure deserialization: pickle.load()

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

pickle.load on tokenizer.pkl will execute attacker-controlled pickle payloads during deserialization. Because the file is read from ~/.cache/autoresearch/tokenizer/tokenizer.pkl, any local attacker, compromised prior process, or poisoned cache population step could turn a later training or evaluation run into arbitrary code execution. The skill's autonomous experiment workflow makes this more dangerous because agents may repeatedly load artifacts without human review.

Content

Scanner excerpt · prepare.py (reported line 219)May include surrounding context.

python

@classmethod
    def from_directory(cls, tokenizer_dir=TOKENIZER_DIR):
        with open(os.path.join(tokenizer_dir, "tokenizer.pkl"), "rb") as f:
            enc = pickle.load(f)
        return cls(enc)

    def get_vocab_size(self):

Insecure deserialization: torch.load() without weights_only=True

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This call deserializes a PyTorch .pt file from a user-writable cache directory using torch.load without restricting loading to tensor weights only. PyTorch deserialization relies on pickle semantics for many object types, so if an attacker can replace ~/.cache/autoresearch/tokenizer/token_bytes.pt, arbitrary code may execute when the file is loaded. In this autonomous research context, code often runs unattended and may process shared or pre-populated caches, which increases the risk.

Content

Scanner excerpt · prepare.py (reported line 251)May include surrounding context.

python

def get_token_bytes(device="cpu"):
    path = os.path.join(TOKENIZER_DIR, "token_bytes.pt")
    with open(path, "rb") as f:
        return torch.load(f, map_location=device)


def _document_batches(split, tokenizer_batch_size=128):

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · program.md (reported line 10)May include surrounding context.

md

To set up a new experiment, work with the user to:

1. **Agree on a run tag**: propose a tag based on today's date (e.g. `mar5`). The branch `autoresearch/<tag>` must not already exist — this is a fresh run.
2. **Create the branch**: `git checkout -b autoresearch/<tag>` from current master.
3. **Read the in-scope files**: The repo is small. Read these files for full context:
   - `README.md` — repository context.
   - `prepare.py` — fixed constants, data prep, tokenizer, dataloader, evaluation. Do not modify.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to modify train.py and create results.tsv, but it does not require a clear user-facing warning or fresh confirmation before making repository changes. In practice this can lead to unintended code edits and untracked file creation in the user's workspace, especially when combined with later autonomous execution behavior.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The instruction LOOP FOREVER creates an unbounded autonomous workflow that repeatedly consumes GPU, CPU, disk, and repository resources until externally interrupted. In this skill context, each iteration launches multi-minute training jobs, so the absence of a built-in stopping condition, budget, or approval checkpoint materially increases the risk of runaway resource consumption.

Content

Scanner excerpt · program.md (reported line 94)May include surrounding context.

md

The experiment runs on a dedicated branch (e.g. `autoresearch/mar5` or `autoresearch/mar5-gpu0`).

LOOP FOREVER:

1. Look at the git state: the current branch/commit we're on
2. Tune `train.py` with an experimental idea by directly hacking the code.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The experiment loop directs the agent to repeatedly git commit and git reset based on experiment outcomes, which are history-altering operations that can discard work or create a large number of commits without an explicit warning each time. This is dangerous because it normalizes autonomous source-control mutation and rollback, increasing the chance of accidental data loss or confusing repository state.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README explicitly fetches and executes an external script from the internet during installation. This is a true supply-chain hazard because users are asked to trust live remote content at execution time, making compromise of the source or transit path equivalent to arbitrary command execution. In an autonomous-research skill, this is somewhat more dangerous because users may be primed to automate setup and run commands quickly.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. Install uv project manager (if you don't already have it)
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. Install dependencies
uv sync

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pyarrow has 9 known advisory(ies) (CVE-2023-47248 (PyArrow: Arbitrary code execution when loading a malicious data file); CVE-2019-12408 (Missing Initialization of Resource in Apache Arrow); CVE-2019-12410 (Missing Initialization of Resource in Apache Arrow) +6 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: train.py:611