registry / AI-agent capability abuse / agenticros / 0.7.21

agenticros@0.7.21

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No malicious npm lifecycle chain or exfiltration was found, but the package provides explicit agent-extension installation and configuration mutation that can execute externally selected code. This warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The user runs a skills install command, or an AgenticROS runtime loads configured skill references; the authentication helper must be run directly.

Impact

A selected third-party skill can execute its own package lifecycle and build code; configuration can register it with OpenClaw. The standalone helper can weaken local gateway authentication.

Mechanism

Marketplace-selected package download, dependency installation, build execution, and agent configuration mutation.

AI rationale

Evidence

runtime/packages/core/src/skill-refs.tsdist/commands/skills.jsdist/util/skills.jsruntime/scripts/setup-openclaw-local.cjs~/.agenticros/skills-cache~/.agenticros/config.json~/.openclaw/openclaw.json

Network endpoints1

skills.agenticros.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The bundled core fetches skill installation metadata from the AgenticROS marketplace.
It installs dependencies and runs build scripts inside downloaded skill directories.
The explicit skills command caches and registers externally supplied skills.
It writes skill references into OpenClaw and AgenticROS configuration files.
A separately invoked helper can disable OpenClaw gateway authentication and delete its token.

Evidence against

The published manifest has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
The reviewed installer and configuration mutations require explicit runtime commands or pre-existing skill references.
No confirmed secret exfiltration, stealth persistence, or automatic install-time execution was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

23 flagged

dist/util/mcp-discovery.jsView file

Lines 1-36javascript

1/**

2 * Bridge from the CLI to the AgenticROS MCP server's `ros2_discover_robots` tool.

3 *

4 * Rather than re-implement live-topic discovery in the CLI (which would

5 * force `@agenticros/core` and its transport deps into the published

6 * `agenticros` tarball), we spawn the existing MCP server binary

7 * (`packages/agenticros-claude-code/dist/index.js`) and JSON-RPC the

8 * `ros2_discover_robots` tool — the exact code path Claude Code uses.

9 * This keeps the CLI light AND ensures the CLI sees the same robots

10 * the agent sees.

11 *

12 * Resilience: the spawn-and-rpc dance is wrapped in an overall timeout

13 * so a hung Zenoh router or a malformed reply can't lock up the CLI.

14 * The stderr stream is drained silently — the MCP server emits a

15 * connection banner that isn't useful for the CLI consumer.

16 */

17import { spawn } from "node:child_process";

18import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

19import { join } from "node:path";

20import { getCliPaths } from "./paths.js";

21const DISCOVER_TIMEOUT_MS = 15_000;

22const INIT_TIMEOUT_MS = 8_000;

23/**

24 * Resolve the path to the AgenticROS MCP server entrypoint, mirroring

25 * the same lookup the rest of the CLI uses. Returns undefined when the

26 * dist hasn't been built yet (so the caller can surface an actionable

27 * error rather than a cryptic spawn failure).

28 */

29export function findMcpEntry() {

30 const { mcpDistDir } = getCliPaths();

31 const entry = join(mcpDistDir, "index.js");

32 return existsSync(entry) ? entry : undefined;

33}

34/** Minimal stdio JSON-RPC client over a child process. */

35class StdioRpc {

36 proc;

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = dist/util/mcp-discovery.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/util/workspace.jsView file

Lines 1-31javascript

1/**

2 * Workspace bring-up helpers used by `agenticros init` and any runner that

3 * needs the JS workspace built before it can launch (currently `up real`;

4 * sim runners don't need TS deps).

5 *

6 * Why shared: across 0.1.2 .. 0.1.6 we kept hitting "user picks Launch

7 * without running init first" failures. Rather than asking the user to

8 * pick the right menu item, we just auto-recover.

9 */

10import { existsSync, writeFileSync }

dist/commands/skills-dev.jsView file

Lines 69-109javascript

69 logger: {

70 info: (...m) => console.log("[skill]", ...m),

71 warn: (...m) => console.warn

dist/util/marketplace.jsView file

Lines 1-23javascript

1/**

2 * Tiny client for the AgenticROS Skills marketplace REST API.

3 *

4 * The marketplace itself is at https://skills.agenticros.com — this CLI

5 * talks to the REST endpoints exposed under /api/ (rewritten by Firebase

6 * Hosting to the `api` Cloud Function). Read-only, no auth.

7 *

8 * Override the base URL via `AGENTICROS_SKILLS_API` for local emulator

9 * testing or staging deployments.

10 */

dist/commands/init.js#virtual:normalized:round1View file

56// strips .npmrc from the published tarball, so we can"t ship it - and even\n // workspace-mode users benefit from having strict-peer-dependencies=false\n // for the init flo... L57: // in .bin" purgatory.\n if (opts.force || !isWorkspaceInstalled(repoRoot)) {\n if (!hasBin("pnpm")) {\n err("pnpm is not installed (or not on PATH). `agenticr... L58: // src/ but install/ is from the previous CLI version" case - without\n // it, init's sk[redacted] logic ships users a\n // stale install dir (e.g. 0.1.10 adde...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L56

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/init.js#virtual:normalized:round1View on unpkg

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView file

•path = runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.py kind = payload_in_excluded_dir sizeBytes = 2122 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView on unpkg

dist/commands/web.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.9 matchedPath = dist/commands/web.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/web.jsView on unpkg

runtime/packages/robot-eyes/lib/sounds.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/robot-eyes/lib/sounds.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/robot-eyes/lib/sounds.jsView on unpkg

runtime/scripts/agenticros-proxy.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/agenticros-proxy.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/agenticros-proxy.cjsView on unpkg

runtime/scripts/openclaw-dashboard-url.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/openclaw-dashboard-url.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/openclaw-dashboard-url.cjsView on unpkg

runtime/scripts/setup-openclaw-local.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/setup-openclaw-local.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/setup-openclaw-local.cjsView on unpkg

runtime/packages/agenticros-claude-code/yolo-debug.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-claude-code/yolo-debug.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-claude-code/yolo-debug.mjsView on unpkg

runtime/scripts/check-cli-tarball-size.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-size.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-size.mjsView on unpkg

runtime/scripts/smoke_test_nemoclaw.shView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/smoke_test_nemoclaw.sh matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/smoke_test_nemoclaw.shView on unpkg

runtime/scripts/test-follow-me-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-follow-me-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-follow-me-sim.mjsView on unpkg

runtime/scripts/test-mcp-e2e.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-mcp-e2e.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-mcp-e2e.mjsView on unpkg

runtime/scripts/test-navigate-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-navigate-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-navigate-sim.mjsView on unpkg

Source & flagged code

23 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/util/workspace.jsView file

11import { join } from "node:path"; L12: import { execa } from "execa"; L13: import { hasBin } from "./env.js";

High

Shell

Findings

19 High6 Medium6 Low

HighChild Processdist/util/mcp-discovery.js

HighShelldist/util/workspace.js

HighSame File Env Network Executiondist/util/marketplace.js

HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py

HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/web.js

HighKnown Malware Source Similaritydist/util/mcp-discovery.js

HighKnown Malware Source Similarityruntime/packages/robot-eyes/lib/sounds.js

Affected versions and remediation

This report applies to agenticros@0.7.21.

See all versions of agenticros for other recorded verdicts.

Review the evidence and your use of agenticros@0.7.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 03:04:58.327Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code