registry / agenticros / 0.7.20

agenticros@0.7.20

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No automatic npm lifecycle execution or confirmed data theft was found. The package nonetheless has meaningful user-invoked AI-agent host mutation and remote skill installation capability.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The user runs agenticros init, MCP setup, or skills install.

Impact

A user-approved setup can expand an AI-agent host's available robot-control capabilities and introduce third-party skill code.

Mechanism

Agent-extension deployment, host configuration mutation, and marketplace skill retrieval.

AI rationale

No automatic npm lifecycle execution or confirmed data theft was found. The package nonetheless has meaningful user-invoked AI-agent host mutation and remote skill installation capability.

Evidence

runtime/scripts/setup_gateway_plugin.shdist/util/openclaw-config.jsruntime/packages/core/src/skill-refs.ts~/.openclaw/openclaw.json~/.agenticros/plugin-deploy~/.agenticros/skills-cache

Network endpoints1

skills.agenticros.com/api

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit init command deploys and registers an AgenticROS plugin with OpenClaw.
Init adds the plugin's tool identifiers to OpenClaw's global allowlist.
User-requested skill installation fetches marketplace metadata and can install packages or clone repositories into a home-directory cache.

Evidence against

package.json has no install, preinstall, or postinstall lifecycle hook.
The control-surface changes occur through explicit CLI setup commands, not npm installation.
No credential harvesting or unrelated outbound exfiltration was found in the reviewed paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 244 file(s), 1.83 MB of source, external domains: 127.0.0.1, ai.google.dev, aistudio.google.com, api.github.com, claude.com, cloud.agenticros.com, corebrum.com, developers.openai.com, docs.ros.org, github.com, host.openshell.internal, huggingface.co, nodejs.org, skills.agenticros.com

Source & flagged code

23 flagged

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = dist/util/mcp-discovery.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/util/workspace.jsView file

11import { join } from "node:path"; L12: import { execa } from "execa"; L13: import { hasBin } from "./env.js";

High

Shell

Package source references shell execution.

dist/util/workspace.jsView on unpkg · L11

dist/commands/skills-dev.jsView file

89}; L90: const require = createRequire(pathToFileURL(entryPath).href); L91: const mod = require(entryPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/skills-dev.jsView on unpkg · L89

dist/util/marketplace.jsView file

3* L4: * The marketplace itself is at https://sk[redacted] — this CLI L5: * talks to the REST endpoints exposed under /api/ (rewritten by Firebase ... L12: import { dirname, basename, join, resolve } from "node:path"; L13: import { execa } from "execa"; L14: import { discoveryRoots } from "./skills.js"; ... L16: export function apiBase() { L17: return (process.env.AGENTICROS_SKILLS_API || DEFAULT_API_BASE).replace(/\/+$/, ""); L18: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/util/marketplace.jsView on unpkg · L3

dist/commands/init.js#virtual:normalized:round1View file

56// strips .npmrc from the published tarball, so we can"t ship it - and even\n // workspace-mode users benefit from having strict-peer-dependencies=false\n // for the init flo... L57: // in .bin" purgatory.\n if (opts.force || !isWorkspaceInstalled(repoRoot)) {\n if (!hasBin("pnpm")) {\n err("pnpm is not installed (or not on PATH). `agenticr... L58: // src/ but install/ is from the previous CLI version" case - without\n // it, init's sk[redacted] logic ships users a\n // stale install dir (e.g. 0.1.10 adde...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L56

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/init.js#virtual:normalized:round1View on unpkg

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView file

•path = runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.py kind = payload_in_excluded_dir sizeBytes = 2122 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView on unpkg

dist/commands/web.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.9 matchedPath = dist/commands/web.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/web.jsView on unpkg

runtime/packages/robot-eyes/lib/sounds.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/robot-eyes/lib/sounds.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/robot-eyes/lib/sounds.jsView on unpkg

runtime/scripts/agenticros-proxy.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/agenticros-proxy.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/agenticros-proxy.cjsView on unpkg

runtime/scripts/openclaw-dashboard-url.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/openclaw-dashboard-url.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/openclaw-dashboard-url.cjsView on unpkg

runtime/scripts/setup-openclaw-local.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/setup-openclaw-local.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/setup-openclaw-local.cjsView on unpkg

runtime/packages/agenticros-claude-code/yolo-debug.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-claude-code/yolo-debug.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-claude-code/yolo-debug.mjsView on unpkg

runtime/scripts/check-cli-tarball-size.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-size.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-size.mjsView on unpkg

runtime/scripts/smoke_test_nemoclaw.shView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/smoke_test_nemoclaw.sh matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/smoke_test_nemoclaw.shView on unpkg

runtime/scripts/test-follow-me-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-follow-me-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-follow-me-sim.mjsView on unpkg

runtime/scripts/test-mcp-e2e.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-mcp-e2e.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-mcp-e2e.mjsView on unpkg

runtime/scripts/test-navigate-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-navigate-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-navigate-sim.mjsView on unpkg

Source & flagged code

23 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/util/workspace.jsView file

11import { join } from "node:path"; L12: import { execa } from "execa"; L13: import { hasBin } from "./env.js";

High

Shell

Findings

19 High6 Medium6 Low

HighChild Processdist/util/mcp-discovery.js

HighShelldist/util/workspace.js

HighSame File Env Network Executiondist/util/marketplace.js

HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py

HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/web.js

HighKnown Malware Source Similaritydist/util/mcp-discovery.js

HighKnown Malware Source Similarityruntime/packages/robot-eyes/lib/sounds.js

Affected versions and remediation

This report applies to agenticros@0.7.20.

See all versions of agenticros for other recorded verdicts.

Review the evidence and your use of agenticros@0.7.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 17:02:43.264Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code