registry / Remote code execution / agenticros

agenticros

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

This report shows the evidence for agenticros@0.6.9. 2 of 36 known versions are blocked or flagged. The newest version, 0.7.36, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The shipped runtime contains a concrete remote-command execution path, not merely a risky primitive. Its explicit-user trigger does not remove the arbitrary server-supplied shell execution.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit agenticros connect command or menu Connect action.

Impact

Remote code execution on the connected robot host; associated channel can command motion and exfiltrate camera images.

Mechanism

Socket event data passed directly to child_process.exec.

Attack narrative

After an explicit connect action, the CLI detaches the shipped comms.js process. That process authenticates to the AgenticROS cloud signaling endpoint, then registers a bash-script event handler that executes its received data as a shell command without validation or authorization checks. A controlling signaling service or an attacker able to emit that event can execute arbitrary commands on the robot host; the same connection also handles robot motion and camera responses.

AI rationale

The shipped runtime contains a concrete remote-command execution path, not merely a risky primitive. Its explicit-user trigger does not remove the arbitrary server-supplied shell execution.

Evidence

package.jsondist/commands/robot-hw.jsruntime/packages/agenticros-robot/comms.jsruntime/packages/agenticros-robot/ros-topics.js

Network endpoints2

wss://cloud.agenticros.comcloud.agenticros.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

runtime/packages/agenticros-robot/comms.js accepts remote "bash-script" socket events and passes data to exec(data).
comms.js connects to wss://cloud.agenticros.com and sends the stored API token in its connection query.
dist/commands/robot-hw.js launches comms.js detached for the explicit agenticros connect command.
The same remote channel can publish ROS velocity commands and return camera images.

Evidence against

package.json has no preinstall/install/postinstall hook; prepublishOnly is publisher-side.
The main CLI only dispatches commands; cloud connection is user-invoked.
The bundled .tgz is a normal source package archive, not an opaque executable payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

11 flagged

dist/util/mcp-discovery.jsView file

Lines 1-36javascript

1/**

2 * Bridge from the CLI to the AgenticROS MCP server's `ros2_discover_robots` tool.

3 *

4 * Rather than re-implement live-topic discovery in the CLI (which would

5 * force `@agenticros/core` and its transport deps into the published

6 * `agenticros` tarball), we spawn the existing MCP server binary

7 * (`packages/agenticros-claude-code/dist/index.js`) and JSON-RPC the

8 * `ros2_discover_robots` tool — the exact code path Claude Code uses.

9 * This keeps the CLI light AND ensures the CLI sees the same robots

10 * the agent sees.

11 *

12 * Resilience: the spawn-and-rpc dance is wrapped in an overall timeout

13 * so a hung Zenoh router or a malformed reply can't lock up the CLI.

14 * The stderr stream is drained silently — the MCP server emits a

15 * connection banner that isn't useful for the CLI consumer.

16 */

17import { spawn } from "node:child_process";

18import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

19import { join } from "node:path";

20import { getCliPaths } from "./paths.js";

21const DISCOVER_TIMEOUT_MS = 15_000;

22const INIT_TIMEOUT_MS = 8_000;

23/**

24 * Resolve the path to the AgenticROS MCP server entrypoint, mirroring

25 * the same lookup the rest of the CLI uses. Returns undefined when the

26 * dist hasn't been built yet (so the caller can surface an actionable

27 * error rather than a cryptic spawn failure).

28 */

29export function findMcpEntry() {

30 const { mcpDistDir } = getCliPaths();

31 const entry = join(mcpDistDir, "index.js");

32 return existsSync(entry) ? entry : undefined;

33}

34/** Minimal stdio JSON-RPC client over a child process. */

35class StdioRpc {

36 proc;

dist/util/workspace.jsView file

Lines 1-31javascript

1/**

2 * Workspace bring-up helpers used by `agenticros init` and any runner that

3 * needs the JS workspace built before it can launch (currently `up real`;

4 * sim runners don't need TS deps).

5 *

6 * Why shared: across 0.1.2 .. 0.1.6 we kept hitting "user picks Launch

7 * without running init first" failures. Rather than asking the user to

8 * pick the right menu item, we just auto-recover.

9 */

10import { existsSync, writeFileSync }

dist/commands/skills-dev.jsView file

Lines 69-109javascript

69 logger: {

70 info: (...m) => console.log("[skill]", ...m),

71 warn: (...m) => console.warn

dist/util/marketplace.jsView file

Lines 1-23javascript

1/**

2 * Tiny client for the AgenticROS Skills marketplace REST API.

3 *

4 * The marketplace itself is at https://skills.agenticros.com — this CLI

5 * talks to the REST endpoints exposed under /api/ (rewritten by Firebase

6 * Hosting to the `api` Cloud Function). Read-only, no auth.

7 *

8 * Override the base URL via `AGENTICROS_SKILLS_API` for local emulator

9 * testing or staging deployments.

10 */

runtime/scripts/check-cli-tarball-install.mjsView file

Lines 177-217javascript

177 }

178 ok(`All ${REQUIRED_RUNTIME_FILES.length} critical runtime files present.`);

179

180 // 4. simulate init: cp -a runtime/. installDir/

181 step("Copying runtime/ into a fresh install dir (simulating `agenticros init`)...");

182 run

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/packages/core/src/memory/local/provider.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/packages/core/src/memory/local/provider.tsView on unpkg

runtime/packages/agenticros-robot/comms.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agenticros@0.5.8 matchedIdentity = npm:YWdlbnRpY3Jvcw:0.5.8 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/packages/agenticros-robot/comms.jsView on unpkg

Source & flagged code

11 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

dist/util/workspace.jsView file

11import { join } from "node:path"; L12: import { execa } from "execa"; L13: import { info, ok, warn, withSpinner } from "./logger.js";

High

Shell

Package source references shell execution.

dist/util/workspace.jsView on unpkg · L11

dist/commands/skills-dev.jsView file

89}; L90: const require = createRequire(pathToFileURL(entryPath).href); L91: const mod = require(entryPath);

Findings

1 Critical6 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltaruntime/packages/agenticros-robot/comms.js

HighChild Processdist/util/mcp-discovery.js

HighShelldist/util/workspace.js

HighSame File Env Network Executiondist/util/marketplace.js

HighRuntime Package Installruntime/scripts/check-cli-tarball-install.mjs

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighSemantic Analysis Limitedruntime/packages/core/src/memory/local/provider.ts

MediumDynamic Requiredist/commands/skills-dev.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/scripts/start_demo.sh

Affected versions and remediation

This report applies to agenticros@0.6.9.

The versions list below shows the verdict for each recorded version.

Avoid installing agenticros@0.6.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 11:05:03.151Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

36 known versions

0.7.36latestManual Review—AllowUnder ReviewOct 22, 2026, 4:14 PM 0.7.35SuspiciousAI-agent capability abuseWarnPublishedOct 16, 2026, 4:03 PM 0.7.34SuspiciousAgent extension lifecycle riskWarnPublishedOct 10, 2026, 5:59 PM 0.7.33SuspiciousAI-agent capability abuseWarnPublishedOct 6, 2026, 10:54 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages