agenticros@0.7.19
AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has elevated, user-invoked agent-extension and remote-skill capabilities, but the inspected manifest lacks an automatic install hook and the relevant setup paths include explicit prompts. This supports a warning rather than a malware block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user runs agenticros init or enables configured skill references.
Impact
A selected remote skill can execute its own install or build code; the setup flow can enable AgenticROS tools in supported agent hosts.
Mechanism
Explicit agent configuration mutation and remote skill installation.
AI rationale
The package has elevated, user-invoked agent-extension and remote-skill capabilities, but the inspected manifest lacks an automatic install hook and the relevant setup paths include explicit prompts. This supports a warning rather than a malware block.
Evidence
runtime/packages/core/src/skill-refs.tsdist/commands/init.jsruntime/scripts/setup_gateway_plugin.sh~/.agenticros/skills-cache~/.openclaw/openclaw.json~/.codex/config.toml
Network endpoints1
skills.agenticros.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Configured skill references can fetch remote npm or Git sources, then run their install and build commands.
- The init command can install an OpenClaw plugin and add its tools to the agent allowlist after confirmation.
- The gateway setup script registers a locally deployed plugin with OpenClaw and can patch its config.
Evidence against
- The package manifest has no install, preinstall, or postinstall hook; its only lifecycle script is prepublishOnly.
- No runtime self-dependency on agenticros was found.
- The agent configuration changes are reached through explicit CLI setup and confirmation flows.
- No credential harvesting or unconsented data exfiltration was found in the inspected sources.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
23 flagged · loading sourcedist/util/mcp-discovery.jsView file
16*/
L17: import { spawn } from "node:child_process";
L18: import { existsSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/util/mcp-discovery.jsView on unpkg · L16•matchType = normalized_sha256
matchedPackage = agenticros@0.6.6
matchedPath = dist/util/mcp-discovery.js
matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/util/mcp-discovery.jsView on unpkgdist/util/workspace.jsView file
11import { join } from "node:path";
L12: import { execa } from "execa";
L13: import { info, ok, warn, withSpinner } from "./logger.js";
High
Findings
19 High6 Medium6 Low
HighChild Processdist/util/mcp-discovery.js
HighShelldist/util/workspace.js
HighSame File Env Network Executiondist/util/marketplace.js
HighRuntime Package Installruntime/scripts/check-cli-tarball-install.mjs
HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz
HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py
HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1
HighKnown Malware Source Similarityruntime/scripts/pack-runtime.mjs
HighKnown Malware Source Similaritydist/commands/web.js
HighKnown Malware Source Similaritydist/util/mcp-discovery.js
Affected versions and remediation
This report applies to agenticros@0.7.19.
See all versions of agenticros for other recorded verdicts.
- Review the evidence and your use of agenticros@0.7.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.