uditgoenka/autoresearch

{   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",

"$schema": "https://anthropic.com/claude-code/marketplace.schema.json",

"owner": {     "name": "Udit Goenka",     "url": "https://github.com/uditgoenka"

"name": "Udit Goenka",     "url": "https://github.com/uditgoenka"   },

"url": "https://github.com/uditgoenka"

"author": {         "name": "Udit Goenka",         "url": "https://github.com/uditgoenka"

"name": "Udit Goenka",         "url": "https://github.com/uditgoenka"       },

"url": "https://github.com/uditgoenka"

Before first dry-run, screen Verify command for: rm -rf, fork bombs, curl|sh, embedded credentials, outbound writes. Block dangerous commands.

[Credential-related source omitted]

3. **Safety screen:** check proposed command for rm -rf, fork bombs, curl|sh, credentials

How a metric loop gets out of an idea basin. Sources: Cai et al., "Fork-and-Flush: Escaping Idea Basins in Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

([arXiv:2610.07625](https://arxiv.org/abs/2610.07625)), for the guided branches.

Verify-command screen (no `rm -rf` / `curl|sh`); worktree cleanup + prune on crash; data-migration refuses any non-allowlisted DB URL; probe auto-skips non-interactively; chained `ship` never auto-deploys.

#!/usr/bin/env bash

# The shell drops quotes and backslashes before it runs a name, so 'rm' and \rm are rm.

# A glob in a command name (r?, /bin/r[m], sudo r*) can match any program, so a glob

# option value (sudo -u root) can come before the name. Globs in arguments

# Each command matcher below starts at a space, ; & | ( ) { ` $ < or >, so `true;rm -rf /   # and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# rm with recursive AND force, in any flag arrangement: bundled (-rf/-Rf/-fr),

# curl/wget piped to an interpreter (sh/bash/zsh/dash/fish/ksh/python/perl/ruby/

# node/php), including a path-qualified one (| /bin/bash). Enumerated interpreters   # rather than "refuse any curl pipe" so a legitimate derived predicate that pipes   # curl output to a parser (jq/grep/awk) is not falsely refused.

# rather than "refuse any curl pipe" so a legitimate derived predicate that pipes

# curl output to a parser (jq/grep/awk) is not falsely refused.

# curl/wget piped through a launcher (sudo, env, exec, ...) into an interpreter.

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# bash -c "$(curl ...)", eval "$(curl ...)".

# bash -c "$(curl ...)", eval "$(curl ...)".

# curl/wget routed through xargs into an interpreter. The xargs wrapper sidesteps the

# Output piped to netcat exfiltrates data off-host.

# find ... -delete mass-removes matched files. Both tokens required so a plain find

#!/usr/bin/env bash

Before first dry-run, screen Verify command for: rm -rf, fork bombs, curl|sh, embedded credentials, outbound writes. Block dangerous commands.

How a metric loop gets out of an idea basin. Sources: Cai et al., "Fork-and-Flush: Escaping Idea Basins in Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

([arXiv:2610.07625](https://arxiv.org/abs/2610.07625)), for the guided branches.

#!/usr/bin/env bash

# The shell drops quotes and backslashes before it runs a name, so 'rm' and \rm are rm.

# A glob in a command name (r?, /bin/r[m], sudo r*) can match any program, so a glob

# option value (sudo -u root) can come before the name. Globs in arguments

# Each command matcher below starts at a space, ; & | ( ) { ` $ < or >, so `true;rm -rf /   # and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# rm with recursive AND force, in any flag arrangement: bundled (-rf/-Rf/-fr),

# curl/wget piped to an interpreter (sh/bash/zsh/dash/fish/ksh/python/perl/ruby/

# node/php), including a path-qualified one (| /bin/bash). Enumerated interpreters   # rather than "refuse any curl pipe" so a legitimate derived predicate that pipes   # curl output to a parser (jq/grep/awk) is not falsely refused.

# rather than "refuse any curl pipe" so a legitimate derived predicate that pipes

# curl output to a parser (jq/grep/awk) is not falsely refused.

# curl/wget piped through a launcher (sudo, env, exec, ...) into an interpreter.

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# bash -c "$(curl ...)", eval "$(curl ...)".

# bash -c "$(curl ...)", eval "$(curl ...)".

# curl/wget routed through xargs into an interpreter. The xargs wrapper sidesteps the

# Output piped to netcat exfiltrates data off-host.

# find ... -delete mass-removes matched files. Both tokens required so a plain find

#!/usr/bin/env bash

"author": {     "name": "Udit Goenka",     "url": "https://github.com/uditgoenka"

"name": "Udit Goenka",     "url": "https://github.com/uditgoenka"   },

"url": "https://github.com/uditgoenka"

},   "repository": "https://github.com/uditgoenka/autoresearch",   "license": "MIT",

"repository": "https://github.com/uditgoenka/autoresearch",

"license": "MIT",   "homepage": "https://github.com/uditgoenka/autoresearch",   "keywords": [

"homepage": "https://github.com/uditgoenka/autoresearch",

Before first dry-run, screen Verify command for: rm -rf, fork bombs, curl|sh, embedded credentials, outbound writes. Block dangerous commands.

How a metric loop gets out of an idea basin. Sources: Cai et al., "Fork-and-Flush: Escaping Idea Basins in Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

([arXiv:2610.07625](https://arxiv.org/abs/2610.07625)), for the guided branches.

#!/usr/bin/env bash

# The shell drops quotes and backslashes before it runs a name, so 'rm' and \rm are rm.

# A glob in a command name (r?, /bin/r[m], sudo r*) can match any program, so a glob

# option value (sudo -u root) can come before the name. Globs in arguments

# Each command matcher below starts at a space, ; & | ( ) { ` $ < or >, so `true;rm -rf /   # and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# rm with recursive AND force, in any flag arrangement: bundled (-rf/-Rf/-fr),

# curl/wget piped to an interpreter (sh/bash/zsh/dash/fish/ksh/python/perl/ruby/

# node/php), including a path-qualified one (| /bin/bash). Enumerated interpreters   # rather than "refuse any curl pipe" so a legitimate derived predicate that pipes   # curl output to a parser (jq/grep/awk) is not falsely refused.

# rather than "refuse any curl pipe" so a legitimate derived predicate that pipes

# curl output to a parser (jq/grep/awk) is not falsely refused.

# curl/wget piped through a launcher (sudo, env, exec, ...) into an interpreter.

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# bash -c "$(curl ...)", eval "$(curl ...)".

# bash -c "$(curl ...)", eval "$(curl ...)".

# curl/wget routed through xargs into an interpreter. The xargs wrapper sidesteps the

# Output piped to netcat exfiltrates data off-host.

# find ... -delete mass-removes matched files. Both tokens required so a plain find

#!/usr/bin/env bash

Before first dry-run, screen Verify command for: rm -rf, fork bombs, curl|sh, embedded credentials, outbound writes. Block dangerous commands.

How a metric loop gets out of an idea basin. Sources: Cai et al., "Fork-and-Flush: Escaping Idea Basins in Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

([arXiv:2610.07625](https://arxiv.org/abs/2610.07625)), for the guided branches.

#!/usr/bin/env bash

# The shell drops quotes and backslashes before it runs a name, so 'rm' and \rm are rm.

# A glob in a command name (r?, /bin/r[m], sudo r*) can match any program, so a glob

# option value (sudo -u root) can come before the name. Globs in arguments

# Each command matcher below starts at a space, ; & | ( ) { ` $ < or >, so `true;rm -rf /   # and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# rm with recursive AND force, in any flag arrangement: bundled (-rf/-Rf/-fr),

# curl/wget piped to an interpreter (sh/bash/zsh/dash/fish/ksh/python/perl/ruby/

# node/php), including a path-qualified one (| /bin/bash). Enumerated interpreters   # rather than "refuse any curl pipe" so a legitimate derived predicate that pipes   # curl output to a parser (jq/grep/awk) is not falsely refused.

# rather than "refuse any curl pipe" so a legitimate derived predicate that pipes

# curl output to a parser (jq/grep/awk) is not falsely refused.

# curl/wget piped through a launcher (sudo, env, exec, ...) into an interpreter.

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# bash -c "$(curl ...)", eval "$(curl ...)".

# bash -c "$(curl ...)", eval "$(curl ...)".

# curl/wget routed through xargs into an interpreter. The xargs wrapper sidesteps the

# Output piped to netcat exfiltrates data off-host.

# find ... -delete mass-removes matched files. Both tokens required so a plain find

#!/usr/bin/env bash

Before first dry-run, screen Verify command for: rm -rf, fork bombs, curl|sh, embedded credentials, outbound writes. Block dangerous commands.

[Credential-related source omitted]

3. **Safety screen:** check proposed command for rm -rf, fork bombs, curl|sh, credentials

How a metric loop gets out of an idea basin. Sources: Cai et al., "Fork-and-Flush: Escaping Idea Basins in Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

Autoresearch Agents" ([arXiv:2610.07447](https://arxiv.org/abs/2610.07447)), for the random branches, and Zhang et

([arXiv:2610.07625](https://arxiv.org/abs/2610.07625)), for the guided branches.

Verify-command screen (no `rm -rf` / `curl|sh`); worktree cleanup + prune on crash; data-migration refuses any non-allowlisted DB URL; probe auto-skips non-interactively; chained `ship` never auto-deploys.

#!/usr/bin/env bash

# The shell drops quotes and backslashes before it runs a name, so 'rm' and \rm are rm.

# A glob in a command name (r?, /bin/r[m], sudo r*) can match any program, so a glob

# option value (sudo -u root) can come before the name. Globs in arguments

# Each command matcher below starts at a space, ; & | ( ) { ` $ < or >, so `true;rm -rf /   # and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# and `$(rm -rf ~)` are seen too. Flags are read from $bare, so rm "-rf" / is too.

# rm with recursive AND force, in any flag arrangement: bundled (-rf/-Rf/-fr),

# curl/wget piped to an interpreter (sh/bash/zsh/dash/fish/ksh/python/perl/ruby/

# node/php), including a path-qualified one (| /bin/bash). Enumerated interpreters   # rather than "refuse any curl pipe" so a legitimate derived predicate that pipes   # curl output to a parser (jq/grep/awk) is not falsely refused.

# rather than "refuse any curl pipe" so a legitimate derived predicate that pipes

# curl output to a parser (jq/grep/awk) is not falsely refused.

# curl/wget piped through a launcher (sudo, env, exec, ...) into an interpreter.

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# A remote payload run without a pipe: bash <(curl ...), source <(curl ...),

# bash -c "$(curl ...)", eval "$(curl ...)".

# bash -c "$(curl ...)", eval "$(curl ...)".

# curl/wget routed through xargs into an interpreter. The xargs wrapper sidesteps the

# Output piped to netcat exfiltrates data off-host.

# find ... -delete mass-removes matched files. Both tokens required so a plain find

#!/usr/bin/env bash