registry / AI-agent capability abuse / agenticros / 0.7.14

agenticros@0.7.14

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Agent config mutation is real but gated by explicit CLI commands and confirm prompts, and package.json never runs it on install. That is a guarded first-party agent capability, so the package should be warned rather than blocked.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Running agenticros init, or agenticros mcp/claude/codex/hermes setup, after the user confirms the matching prompt.

Impact

The user's agent hosts gain an AgenticROS MCP server and, when OpenClaw config already exists, extra tool allowlist entries. Other MCP servers are left in place. This is first-party setup, not a silent install-time hijack.

Mechanism

Confirmed setup merges an agenticros stdio server into host MCP files. init also calls ensureToolsAlsoAllow, which reads ~/.openclaw/openclaw.json and appends contract tool names when the config and plugin manifest already exist.

AI rationale

Evidence

package.jsondist/commands/init.jsdist/util/claude-config.jsdist/util/codex-config.jsdist/util/mcp-setup.jsdist/util/openclaw-config.js~/.codex/config.toml~/.openclaw/openclaw.json.mcp.jsonclaude_desktop_config.json

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json has no preinstall, install, or postinstall hook; scripts are build, test, and prepublishOnly only.
agenticros init asks before installing the OpenClaw plugin and before writing Codex, Hermes, and Claude MCP config.
setupClaudeMcp writes a single agenticros stdio MCP entry into the project .mcp.json or the Claude Desktop config.
Global Codex registration targets ~/.codex/config.toml and is reached from explicit CLI setup, not from npm install.
During init, syncToolsAlsoAllow appends AgenticROS tool ids into an existing ~/.openclaw/openclaw.json tools.alsoAllow list whenever that file and the plugin manifest are already present.

Evidence against

MCP and plugin writes preserve unrelated server keys and only add the agenticros entry or tool ids.
The OpenClaw installer and the multi-host MCP write are behind confirm prompts, and setup commands are exported as user subcommands.
No eval, credential harvest, or install-time network exfiltration was found in the CLI entrypoint.

Behavioral surface

Source

ChildProcess

Source & flagged code

22 flagged

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = dist/util/mcp-discovery.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

High

Shell

Package source references shell execution.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L21

195* Why we no longer shell out to `cp`: on Windows there is no `cp` binary L196: * (PowerShell uses `Copy-Item`), so `execa("cp", ...)` would fail with L197: * "'cp' is not recognized as an internal or external command" the moment L198: * `npx agenticros init` tried to copy the bundle. L199: */

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L195

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/init.js#virtual:normalized:round1View on unpkg

dist/commands/skills-dev.jsView file

89}; L90: const require = createRequire(pathToFileURL(entryPath).href); L91: const mod = require(entryPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/skills-dev.jsView on unpkg · L89

dist/util/marketplace.jsView file

3* L4: * The marketplace itself is at https://sk[redacted] — this CLI L5: * talks to the REST endpoints exposed under /api/ (rewritten by Firebase ... L12: import { dirname, basename, join, resolve } from "node:path"; L13: import { execa } from "execa"; L14: import { discoveryRoots } from "./skills.js"; ... L16: export function apiBase() { L17: return (process.env.AGENTICROS_SKILLS_API || DEFAULT_API_BASE).replace(/\/+$/, ""); L18: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/util/marketplace.jsView on unpkg · L3

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/scripts/pack-runtime.mjsView file

•matchType = token_shingles matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/pack-runtime.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/pack-runtime.mjsView on unpkg

dist/commands/web.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.9 matchedPath = dist/commands/web.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/web.jsView on unpkg

runtime/packages/robot-eyes/lib/sounds.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/robot-eyes/lib/sounds.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/robot-eyes/lib/sounds.jsView on unpkg

runtime/scripts/agenticros-proxy.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/agenticros-proxy.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/agenticros-proxy.cjsView on unpkg

runtime/scripts/check-cli-tarball-install.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-install.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-install.mjsView on unpkg

runtime/scripts/openclaw-dashboard-url.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/openclaw-dashboard-url.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/openclaw-dashboard-url.cjsView on unpkg

runtime/scripts/setup-openclaw-local.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/setup-openclaw-local.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/setup-openclaw-local.cjsView on unpkg

runtime/packages/agenticros-claude-code/yolo-debug.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-claude-code/yolo-debug.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-claude-code/yolo-debug.mjsView on unpkg

runtime/packages/agenticros-robot/start-motors.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-robot/start-motors.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-robot/start-motors.jsView on unpkg

runtime/scripts/check-cli-tarball-size.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-size.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-size.mjsView on unpkg

runtime/scripts/smoke_test_nemoclaw.shView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/smoke_test_nemoclaw.sh matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/smoke_test_nemoclaw.shView on unpkg

Source & flagged code

22 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

Findings

18 High6 Medium6 Low

HighChild Processdist/util/mcp-discovery.js

HighShelldist/commands/init.js#virtual:normalized:round1

HighSame File Env Network Executiondist/util/marketplace.js

HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1

HighKnown Malware Source Similarityruntime/scripts/pack-runtime.mjs

HighKnown Malware Source Similaritydist/commands/web.js

HighKnown Malware Source Similaritydist/util/mcp-discovery.js

HighKnown Malware Source Similarityruntime/packages/robot-eyes/lib/sounds.js

Affected versions and remediation

This report applies to agenticros@0.7.14.

See all versions of agenticros for other recorded verdicts.

Review the evidence and your use of agenticros@0.7.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:38:35.106Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code