registry / agenticros / 0.7.25

agenticros@0.7.25

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The inspected source supports a guarded first-party agent extension lifecycle warning under the supplied policy. Explicit invocation, installation confirmation, and absence of npm install hooks do not support a malicious publish block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Running agenticros init; plugin installation additionally requires confirmation.

Impact

OpenClaw can load replacement extension code and expose additional robot tools. Later init runs can synchronize newly listed tools without a separate allowlist prompt.

Mechanism

Setup copies deployed plugin code into the AgenticROS extension directory and synchronizes manifest tool identifiers into tools.alsoAllow whenever configuration and manifest are present.

AI rationale

Evidence

dist/index.jsdist/commands/init.jsdist/util/openclaw-config.jsruntime/scripts/setup_gateway_plugin.sh~/.openclaw/openclaw.json${OPENCLAW_HOME:-$HOME/.openclaw}/extensions/agenticros

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI explicitly dispatches the init command to setup code.
Init prompts before running the OpenClaw plugin installer.
The installer replaces AgenticROS extension code in OpenClaw's extensions directory.
Init separately synchronizes manifest tools into OpenClaw's allowlist and writes changed configuration.
package.json has no preinstall, install, or postinstall hook.

Evidence against

Plugin installation requires confirmation during an explicit CLI command.
Inspected behavior manages the package's own extension; no concrete malicious attack was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 252 file(s), 1.89 MB of source, external domains: 127.0.0.1, ai.google.dev, aistudio.google.com, antigravity.google, api.github.com, claude.com, cloud.agenticros.com, corebrum.com, developers.openai.com, docs.ros.org, github.com, host.openshell.internal, huggingface.co, nodejs.org, skills.agenticros.com

Source & flagged code

24 flagged

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = dist/util/mcp-discovery.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

High

Shell

Package source references shell execution.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L21

56// strips .npmrc from the published tarball, so we can"t ship it - and even\n // workspace-mode users benefit from having strict-peer-dependencies=false\n // for the init flo... L57: // in .bin" purgatory.\n if (opts.force || !isWorkspaceInstalled(repoRoot)) {\n if (!hasBin("pnpm")) {\n err("pnpm is not installed (or not on PATH). `agenticr... L58: // src/ but install/ is from the previous CLI version" case - without\n // it, init's sk[redacted] logic ships users a\n // stale install dir (e.g. 0.1.10 adde...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L56

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/init.js#virtual:normalized:round1View on unpkg

dist/util/workspace.jsView file

112for (const from of requireFrom) { L113: const req = createRequire(from); L114: for (const pkg of candidates) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/util/workspace.jsView on unpkg · L112

dist/util/marketplace.jsView file

3* L4: * The marketplace itself is at https://sk[redacted] — this CLI L5: * talks to the REST endpoints exposed under /api/ (rewritten by Firebase ... L12: import { dirname, basename, join, resolve } from "node:path"; L13: import { execa } from "execa"; L14: import { discoveryRoots } from "./skills.js"; ... L16: export function apiBase() { L17: return (process.env.AGENTICROS_SKILLS_API || DEFAULT_API_BASE).replace(/\/+$/, ""); L18: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/util/marketplace.jsView on unpkg · L3

dist/util/agy-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, isabsolute, join, resolve } from "node:path"; const agenticros_server_key = "agenticros"; export function globalagymcpconfigpath() { return join(homedir(), ".gemini", "config", "mcp_config.json"); } export function projectagymcpconfigpath(cwd = process.cwd()) { return join(cwd, ".agents", "mcp_config.json"); } export function globalagyskillpath() { return j

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/util/agy-config.jsView on unpkg

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView file

•path = runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.py kind = payload_in_excluded_dir sizeBytes = 2122 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView on unpkg

dist/commands/web.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.9 matchedPath = dist/commands/web.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/web.jsView on unpkg

runtime/packages/robot-eyes/lib/sounds.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/robot-eyes/lib/sounds.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/robot-eyes/lib/sounds.jsView on unpkg

runtime/scripts/agenticros-proxy.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/agenticros-proxy.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/agenticros-proxy.cjsView on unpkg

runtime/scripts/openclaw-dashboard-url.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/openclaw-dashboard-url.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/openclaw-dashboard-url.cjsView on unpkg

runtime/scripts/setup-openclaw-local.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/setup-openclaw-local.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/setup-openclaw-local.cjsView on unpkg

runtime/packages/agenticros-claude-code/yolo-debug.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-claude-code/yolo-debug.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-claude-code/yolo-debug.mjsView on unpkg

runtime/scripts/check-cli-tarball-size.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-size.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-size.mjsView on unpkg

runtime/scripts/smoke_test_nemoclaw.shView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/smoke_test_nemoclaw.sh matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/smoke_test_nemoclaw.shView on unpkg

runtime/scripts/test-follow-me-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-follow-me-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-follow-me-sim.mjsView on unpkg

runtime/scripts/test-mcp-e2e.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-mcp-e2e.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-mcp-e2e.mjsView on unpkg

runtime/scripts/test-navigate-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-navigate-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-navigate-sim.mjsView on unpkg

Source & flagged code

24 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

Findings

20 High6 Medium6 Low

HighChild Processdist/util/mcp-discovery.js

HighShelldist/commands/init.js#virtual:normalized:round1

HighSame File Env Network Executiondist/util/marketplace.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/util/agy-config.js

HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py

HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/web.js

HighKnown Malware Source Similaritydist/util/mcp-discovery.js

Affected versions and remediation

This report applies to agenticros@0.7.25.

See all versions of agenticros for other recorded verdicts.

Review the evidence and your use of agenticros@0.7.25 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 18:27:25.866Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code