registry / agenticros / 0.7.34

agenticros@0.7.34

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Inspected source shows guarded first-party agent setup, including an Antigravity permission grant for the package's own MCP tools. This supports a warning for agent extension lifecycle risk, but not a malicious verdict.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the setup wizard and accepts its plugin or MCP configuration prompts.

Impact

The configured agent may invoke the package's MCP tools without asking each time, increasing the effect of using those tools.

Mechanism

The wizard writes agent configuration and adds an Antigravity allow rule for every AgenticROS MCP tool.

AI rationale

Evidence

package.jsondist/commands/init.jsdist/util/agy-config.js

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has no install hook; its only lifecycle hook is prepublishOnly, which runs build and packaging checks.
The setup wizard asks before installing the OpenClaw plugin and runs its installer only after consent.
The wizard separately asks before configuring MCP clients and invokes setup only on approval.
Antigravity setup adds an allow rule covering every tool exposed by the AgenticROS MCP server.

Evidence against

The agent configuration changes are initiated through the package setup flow, which prompts the user before applying them.
The Antigravity permission rule is limited to the package's own MCP server; other tools remain subject to their existing permissions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

24 flagged

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = dist/util/mcp-discovery.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

High

Shell

Package source references shell execution.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L21

56// strips .npmrc from the published tarball, so we can"t ship it - and even\n // workspace-mode users benefit from having strict-peer-dependencies=false\n // for the init flo... L57: // in .bin" purgatory.\n if (opts.force || !isWorkspaceInstalled(repoRoot)) {\n if (!hasBin("pnpm")) {\n err("pnpm is not installed (or not on PATH). `agenticr... L58: // src/ but install/ is from the previous CLI version" case - without\n // it, init's sk[redacted] logic ships users a\n // stale install dir (e.g. 0.1.10 adde...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L56

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/init.js#virtual:normalized:round1View on unpkg

dist/util/workspace.jsView file

112for (const from of requireFrom) { L113: const req = createRequire(from); L114: for (const pkg of candidates) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/util/workspace.jsView on unpkg · L112

dist/util/marketplace.jsView file

3* L4: * The marketplace itself is at https://sk[redacted] — this CLI L5: * talks to the REST endpoints exposed under /api/ (rewritten by Firebase ... L12: import { dirname, basename, join, resolve } from "node:path"; L13: import { execa } from "execa"; L14: import { discoveryRoots } from "./skills.js"; ... L16: export function apiBase() { L17: return (process.env.AGENTICROS_SKILLS_API || DEFAULT_API_BASE).replace(/\/+$/, ""); L18: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/util/marketplace.jsView on unpkg · L3

dist/util/agy-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, isabsolute, join, resolve } from "node:path"; const agenticros_server_key = "agenticros"; export function globalagymcpconfigpath() { return join(homedir(), ".gemini", "config", "mcp_config.json"); } export function projectagymcpconfigpath(cwd = process.cwd()) { return join(cwd, ".agents", "mcp_config.json"); } export function globalagyskillpath() { return j

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/util/agy-config.jsView on unpkg

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView file

•path = runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.py kind = payload_in_excluded_dir sizeBytes = 2122 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView on unpkg

dist/commands/web.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.9 matchedPath = dist/commands/web.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/web.jsView on unpkg

runtime/scripts/agenticros-proxy.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/agenticros-proxy.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/agenticros-proxy.cjsView on unpkg

runtime/scripts/openclaw-dashboard-url.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/openclaw-dashboard-url.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/openclaw-dashboard-url.cjsView on unpkg

runtime/scripts/setup-openclaw-local.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/setup-openclaw-local.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/setup-openclaw-local.cjsView on unpkg

runtime/packages/agenticros-claude-code/yolo-debug.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-claude-code/yolo-debug.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-claude-code/yolo-debug.mjsView on unpkg

runtime/scripts/check-cli-tarball-size.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-size.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-size.mjsView on unpkg

runtime/scripts/smoke_test_nemoclaw.shView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/smoke_test_nemoclaw.sh matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/smoke_test_nemoclaw.shView on unpkg

runtime/scripts/test-follow-me-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-follow-me-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-follow-me-sim.mjsView on unpkg

runtime/scripts/test-mcp-e2e.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-mcp-e2e.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-mcp-e2e.mjsView on unpkg

runtime/scripts/test-navigate-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-navigate-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-navigate-sim.mjsView on unpkg

runtime/packages/robot-eyes/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agenticros@0.7.33 matchedIdentity = npm:YWdlbnRpY3Jvcw:0.7.33 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/packages/robot-eyes/src/index.jsView on unpkg

Source & flagged code

24 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

Findings

1 Critical19 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltaruntime/packages/robot-eyes/src/index.js

HighChild Processdist/util/mcp-discovery.js

HighShelldist/commands/init.js#virtual:normalized:round1

HighSame File Env Network Executiondist/util/marketplace.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/util/agy-config.js

HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py

HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1

High

Affected versions and remediation

This report applies to agenticros@0.7.34.

See all versions of agenticros for other recorded verdicts.

Review the evidence and your use of agenticros@0.7.34 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 18:03:56.729Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code