Open Science AI Agent by aipoch

by aipoch• 5.4k•• Scanned•Claim this listing•Request removal
Research & Analysisagent skillsai agentai for scienceai researchai research workbench

The open-source AI research workbench for scientific research and agent workflows. Local-first, model-agnostic desktop app with extensible skills, MCP tools and connectors, Python/R execution and traceable artifacts for reproducible research on macOS, Windows and Linux.

Open Science is an open-source ai agent by aipoch, written mainly in TypeScript, with 5,413 GitHub stars and the Apache-2.0 license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 0a25710. Seen able to run dynamic code, read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at 0a25710 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit10 known vulnerabilitieswarn
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (85)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • medium
    @modelcontextprotocol/sdk@1.31.0: 4 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-rvq5-wwqv-78pq
    package-lock.json
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    package-lock.json
  • medium
    Install or build failed in a clean environment
    89s, clean). > open-science@1.0.8 typecheck:compiled > npm run typecheck:node:compiled && npm run typecheck:web:compiled > open-science@1.0.8 typecheck:node:compiled > node node_modules/typescript-native/bin/tsc --noEmit -p tsconfig.node.json --composite false && npm run typecheck:sandbox Killed
  • medium
    Install contacted hosts other than package registries
    binaries.prisma.sh, cdn.npmmirror.com, checkpoint.prisma.io, registry.npmmirror.com, statics.aipoch.com
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/ai-review-labels.test.ts:155
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/ai-review-workflows.test.ts:383
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/ai-review-workflows.test.ts:429
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/pdfjs-resource-scope.test.ts:35
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/main/acp/claude-agent-acp-patch.test.ts:285
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/main/acp/runtime-coordinator.test.ts:4973
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/main/agent-framework/opencode.test.ts:23
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/main/compute/compute-auth-owner.test.ts:788
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/main/compute/prisma-client.test.ts:44
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/main/compute/prisma-client.test.ts:53
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/main/compute/repository.test.ts:234
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/main/compute/repository.test.ts:242
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/main/notebook/mcp-server.test.ts:2230
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/main/notebook/wsl2-shell.integration.test.ts:236
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/main/session-details/owner.test.ts:613
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/main/session-persistence/coordinator-contract.test.ts:910
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/main/settings/claude-install.test.ts:101
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/main/settings/claude-install.test.ts:126
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/main/settings/claude-install.test.ts:139
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/main/settings/codex-auth.test.ts:717
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/main/update/installation-occupancy.test.ts:315
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/shared/local-fs.test.ts:81
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/shared/local-fs.test.ts:82
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/shared/local-fs.test.ts:83
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/shared/local-fs.test.ts:87
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/shared/local-fs.test.ts:91
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/shared/settings.test.ts:258
  • low
    Possible example credential in docs/tests: generic-api-key
    e2e/session-residency-capacity.spec.ts:96
  • low
    Possible example credential in docs/tests: private-key
    e2e/source-preview-storage.spec.ts:39
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/diagnostics/src/startup-error.test.ts:182
  • low
    Possible example credential in docs/tests: jwt
    packages/diagnostics/src/startup-error.test.ts:175
  • low
    Possible example credential in docs/tests: generic-api-key
    10 matches in this file
    packages/diagnostics/src/logger.test.ts:113
  • low
    Possible example credential in docs/tests: jwt
    packages/diagnostics/src/logger.test.ts:394
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/pdf-translation/test/contracts.test.ts:43
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/providers/src/errors.test.ts:4
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/acp/auto-operation-inventory.test.ts:189
  • low
    Possible example credential in docs/tests: generic-api-key
    scripts/windows-installer-smoke.test.ts:594
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/acp/prompt-turn-workflow.test.ts:1412
  • low
    Possible example credential in docs/tests: curl-auth-user
    src/main/acp/permission-broker-registry.test.ts:811
  • low
    Possible example credential in docs/tests: curl-auth-header
    src/main/acp/runtime-events.test.ts:454
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/acp/runtime-plan-composition.test.ts:1613
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/agents/agents-mutations.test.ts:847
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/acp/runtime.test.ts:5709
  • low
    Possible example credential in docs/tests: curl-auth-user
    src/main/acp/permission-broker.test.ts:1948
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    src/main/literature/pdf-translation/index.test.ts:74
  • low
    Possible example credential in docs/tests: private-key
    src/main/notebook/trust-bundle.test.ts:57
  • low
    Possible example credential in docs/tests: curl-auth-user
    3 matches in this file
    src/main/permission-grants/capability.test.ts:12
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/session-diagnostics/export-evidence.integration.test.ts:120
  • low
    Possible example credential in docs/tests: private-key
    src/main/runtime-network-node.integration.test.ts:196
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/session-diagnostics/notebook.test.ts:56
  • low
    Possible example credential in docs/tests: jwt
    src/main/memory/service.test.ts:929
  • low
    Possible example credential in docs/tests: gitlab-pat
    2 matches in this file
    src/main/memory/service.test.ts:926
  • low
    Possible example credential in docs/tests: aws-access-token
    4 matches in this file
    src/main/session-diagnostics/projection.test.ts:117
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/session-package/sensitive-content.test.ts:678
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/settings/bootstrap.integration.test.ts:216
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/settings/connector-template.test.ts:332
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    src/main/settings/codex-auth.test.ts:42
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/settings/provider-auth-lifecycle.test.ts:153
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    src/main/settings/service.test.ts:444
  • low
    Possible example credential in docs/tests: generic-api-key
    src/main/storage/migration-service.test.ts:1199
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    src/renderer/src/pages/literature/JournalManager.render.test.tsx:485
  • low
    Possible example credential in docs/tests: generic-api-key
    src/renderer/src/pages/literature/LiteratureLibraryPage.render.test.tsx:7069
  • low
    Possible example credential in docs/tests: generic-api-key
    src/shared/pdf-translation.test.ts:21
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    package-lock.json
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    package-lock.json
  • low
    minimatch@10.2.6: 2 known vulnerabilities
    GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    package.json has a postinstall script
    node scripts/prepare-shadcn-patch.mjs && patch-package --error-on-fail && node scripts/check-claude-acp-patch.mjs && prisma generate && install-electron && node scripts/install-native-components.mjs &…
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
binaries.prisma.shcdn.npmmirror.comcheckpoint.prisma.iogithub.comregistry.npmjs.orgregistry.npmmirror.comrelease-assets.githubusercontent.comstatics.aipoch.com
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Open Science alternatives

View more →

Similar ai agents in Research & Analysis, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Open Science (this page)
aipoch
5.4kApache-2.0Nov 1, 2026Scanned, no flagged issues
Hermes Agent
NousResearch
259kMITNov 1, 2026Scanned, no flagged issues
Anything LLM
Mintplex-Labs
68kMITOct 30, 2026Scanned, no flagged issues
Khazix Skills
KKKKhazix
22kMITOct 1, 2026Scanned, no flagged issues
Hermes Webui
nesquena
19kMITNov 1, 2026Scanned, no flagged issues
DocsGPT
arc53
18kMITNov 1, 2026Scanned, no flagged issues