autodidact

v1.0.7 suspicious
6.0
Medium Risk

Self-learning AI agent that gets smarter over time. Routes between local and cloud models by confidence; learns from every escalation.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits significant risks related to network and shell command execution, along with potential credential harvesting. However, there is no clear indication of malicious intent.

  • High network risk due to unspecified localhost and external URL interactions
  • Elevated shell risk from potentially dangerous command executions
Per-check LLM notes
  • Network: The network calls to localhost and external URLs may indicate unexpected behavior unless documented as part of the package's functionality.
  • Shell: Executing shell commands, especially those related to downloading software or querying GPU information, can be risky if not properly disclosed or controlled within the package.
  • Obfuscation: No signs of obfuscation detected.
  • Credentials: Potential risk of credential harvesting as the code checks for AWS credentials in various locations.
  • Metadata: The author's information is sparse and the account seems new or inactive, raising some suspicion but not conclusive evidence of malice.

📦 Package Quality Overall: Medium (6.2/10)

✦ High Test Suite 9.0

Test suite present — 40 test file(s) found

  • Test runner config found: pyproject.toml
  • 40 test file(s) detected (e.g. test_agent.py)
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (11687 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 180 type-annotated function signatures detected in source
✦ High Multiple Contributors 8.0

Active multi-contributor project

  • 3 unique contributor(s) across 100 commits in BuffaloTechRider/Autodidact
  • Small but multi-author team (3–4 contributors)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

  • try: resp = requests.post(url, json=body, timeout=self.config.timeout_seconds)
  • try: resp = requests.post( url, json=body,
  • """ try: resp = requests.post( "http://localhost:11434/api/show",
  • """ try: resp = requests.get("http://localhost:11434/api/tags", timeout=2.0) retu
  • """ try: resp = requests.get(_OPENROUTER_MODELS_URL, timeout=10.0) resp.raise_for
✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • "]]: try: subprocess.run(cmd, capture_output=True, timeout=5) except (OSError
  • install_ollama_result = subprocess.run( ["bash", "-c", "curl -fsSL https://ollama.com/i
  • one try: result = subprocess.run( ["nvidia-smi", "--query-gpu=memory.total", "--f
  • """ try: result = subprocess.run( ["ollama", "list"], capture_output=
  • """ try: result = subprocess.run( ["ollama", "pull", model_name], tim
  • """ try: result = subprocess.run(["brew", "--version"], capture_output=True, timeout=5)
⚠ Credential Harvesting score 10.0

Found 5 credential access pattern(s)

  • ) assert os.environ.get("AWS_BEARER_TOKEN_BEDROCK") == "bedrock-xyz" finally:
  • credential chain (env vars, ~/.aws/credentials, SSO, IMDS)", "IAM User (paste aws_access_key_id an
  • tial chain (env # vars, ~/.aws/credentials, SSO, IMDS, etc. — what existing users had # before the
  • chain # (env vars, ~/.aws/credentials, SSO, IMDS, role assumption, etc.). self._bedrock_
  • credential chain (env vars, ~/.aws/credentials, SSO, IMDS)", "us.anthropic.claude-haiku-4-2025
✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository BuffaloTechRider/Autodidact appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with autodidact 
Develop a mini-application named 'SmartQueryBot' that leverages the 'autodidact' package to handle user queries efficiently and intelligently. The application should be designed to answer a wide range of questions related to a specific domain, such as weather, sports, or technology news. Here are the key steps and features to implement:

1. **Setup and Configuration**: Begin by installing the 'autodidact' package and setting up your environment. Configure the bot to connect to both local machine learning models and cloud-based models, ensuring it has the necessary API keys and access permissions.

2. **User Interface**: Design a simple yet intuitive user interface where users can input their queries. This could be a basic command-line interface or a web-based frontend using frameworks like Flask or Django.

3. **Query Processing**: Implement a feature within SmartQueryBot that processes incoming queries. Utilize the 'autodidact' package to route these queries either to a local model or a cloud-based model based on the complexity and specificity of the query.

4. **Learning Mechanism**: Integrate the learning capabilities of 'autodidact'. When the bot escalates a query to the cloud due to uncertainty, ensure that it captures the response and uses it to improve its local model over time. This will make the bot smarter with each interaction.

5. **Feedback Loop**: Allow users to provide feedback on the accuracy of the responses. Use this feedback to further refine the bot’s learning process and improve future interactions.

6. **Performance Monitoring**: Include functionality to monitor the performance of the bot over time. Track metrics such as query resolution time, accuracy rates, and user satisfaction levels to continuously optimize the system.

7. **Documentation and Deployment**: Document all aspects of the project, including setup instructions, configuration details, and usage guidelines. Finally, deploy the application in a way that makes it accessible to end-users, whether through a public server or a private deployment.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!