registry / agenticros / 0.7.17
agenticros@0.7.17
AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe package mutates an AI-agent control surface through an explicit, confirmed setup workflow. This is a concrete extension capability risk but does not meet the threshold for an unconsented lifecycle attack or malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user runs the agenticros init command and accepts the OpenClaw plugin prompt.
Impact
The OpenClaw agent gains the first-party AgenticROS tool capability after user-approved setup.
Mechanism
The command invokes the plugin installer, then adds missing AgenticROS tool IDs to OpenClaw's also-allow configuration and writes the config.
AI rationale
The package mutates an AI-agent control surface through an explicit, confirmed setup workflow. This is a concrete extension capability risk but does not meet the threshold for an unconsented lifecycle attack or malware.
Evidence
dist/commands/init.jsdist/util/openclaw-config.js~/.openclaw/openclaw.json
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI exposes an explicit init command that includes OpenClaw plugin installation and asks the user to confirm it.
- When that setup runs, it synchronizes the AgenticROS tool IDs into OpenClaw's tool allowlist and writes the changed configuration.
- The configuration helper only appends new tool identifiers and preserves existing entries.
Evidence against
- The plugin installation is gated by an interactive confirmation in the explicit init workflow.
- No npm install lifecycle hook was found in the root package manifest.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
22 flagged · loading sourcedist/util/mcp-discovery.jsView file
16*/
L17: import { spawn } from "node:child_process";
L18: import { existsSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/util/mcp-discovery.jsView on unpkg · L16•matchType = normalized_sha256
matchedPackage = agenticros@0.6.6
matchedPath = dist/util/mcp-discovery.js
matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/util/mcp-discovery.jsView on unpkgdist/commands/init.js#virtual:normalized:round1View file
21import { confirm, input, password, select } from "@inquirer/prompts";
L22: import { execa } from "execa";
L23: import { runDoctorChecks } from "./doctor.js";
Findings
18 High6 Medium5 Low
HighChild Processdist/util/mcp-discovery.js
HighShelldist/commands/init.js#virtual:normalized:round1
HighSame File Env Network Executiondist/util/marketplace.js
HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1
HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz
HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1
HighKnown Malware Source Similarityruntime/scripts/pack-runtime.mjs
HighKnown Malware Source Similaritydist/commands/web.js
HighKnown Malware Source Similaritydist/util/mcp-discovery.js
HighKnown Malware Source Similarityruntime/packages/robot-eyes/lib/sounds.js
Affected versions and remediation
This report applies to agenticros@0.7.17.
See all versions of agenticros for other recorded verdicts.
- Review the evidence and your use of agenticros@0.7.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.