`--run-selected` executes an automatically selected, untrusted README command on the host
Source references: 5The orchestrator extracts commands from repository documentation and chooses one heuristically. With `--run-selected`, that command string reaches the persistent runner and is launched through `subprocess.Popen`. Presence in a README is not the same as per-command user review.
A malicious or compromised repository can disguise a Python script or other program as an inference, evaluation, or training example and run with the user's permissions, allowing file access or modification, network activity, resource consumption, or use of logged-in tools.
The risk is supported, but execution occurs only when the user explicitly passes `--run-selected`. The orchestrator extracts candidates from README-linked documentation, selects one by category and score, and passes it to a runner that launches it with `subprocess.Popen` in the target repository. Repository-controlled README content is not necessarily individually reviewed. A user can omit the flag and require the final argv, source location, and working directory to be shown before approval.
for category in ["inference", "evaluation", "training", "other"]: candidates = [item for item in commands if item.get("category") == category] if not candidates: continue runnable = [ item for item in candidates if not item.get("needs_substitution") and command_feasibility(item, repo_path)[0] ] if not runnable: continue best = max(runnable, key=lambda item: command_score(item, produced_out_dirs)) return { "selected_goal": category, "goal_priority": category, "documented_command": best.get("command", ""), "command_source": best.get("source", "readme"),Show 4 other places
) else: run_data = maybe_run_command( repo_path, chosen["documented_command"], args.timeout, args.user_language, args.shell_mode, runtime_root, model_adapter, args.monitor_gpu, ) try: argv = build_command(command, shell_mode) environment = dict(os.environ if child_env is None else child_env) spec["requested_argv"] = list(argv) atomic_write_json(run_dir / "spec.json", spec) if shell_mode == "direct": argv = resolve_direct_argv(argv, repo, environment) spec["argv"] = list(argv) atomic_write_json(run_dir / "spec.json", spec) creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0 process = subprocess.Popen( argv, env=environment, cwd=repo, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", bufsize=1, creationflags=creationflags, start_new_session=os.name != "nt", ) except (FileNotFoundError, ShellSyntaxRequired, OSError, ValueError) as exc: parser.add_argument("--user-language", default="en", help="Language tag for human-readable reports.") parser.add_argument("--run-selected", action="store_true", help="Execute the selected documented command.") parser.add_argument("--include-analysis-pass", action="store_true", help="Run analyze-project and record its outputs in the stage ledger.") creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0 process = subprocess.Popen( argv, env=environment, cwd=repo, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", bufsize=1, creationflags=creationflags, start_new_session=os.name != "nt", ) except (FileNotFoundError, ShellSyntaxRequired, OSError, ValueError) as exc: