agenticros@0.7.35
AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe explicit setup helper leaves a concrete conditional risk because it disables gateway authentication without checking the bind address. Its user-invoked trigger and loopback warning do not establish malicious behavior, and no npm install-time attack was identified.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the setup-openclaw-local.cjs command.
Impact
If the gateway is reachable beyond loopback, disabling authentication could expose it without a token.
Mechanism
The script sets gateway.auth.mode to none, deletes an existing token, and writes the updated configuration.
AI rationale
The explicit setup helper leaves a concrete conditional risk because it disables gateway authentication without checking the bind address. Its user-invoked trigger and loopback warning do not establish malicious behavior, and no npm install-time attack was identified.
Evidence
runtime/scripts/setup-openclaw-local.cjs
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manually run OpenClaw setup script changes gateway authentication to none and removes its token; the config is then written back.
- The script warns that it should only be used on a loopback-bound gateway, but the inspected setup path does not verify the bind address before changing authentication.
- The package manifest lists prepublishOnly, not an install lifecycle hook, so this behavior is not shown to run automatically during npm installation.
Evidence against
- The README presents the no-auth helper for local development, and the script explicitly warns against using it on a LAN or internet-facing gateway.
- The bundled runtime archive could not be inspected as source, so its behavior remains unresolved; that limitation alone does not establish malicious behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
23 flagged · loading sourcedist/util/mcp-discovery.jsView file
16*/
L17: import { spawn } from "node:child_process";
L18: import { existsSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/util/mcp-discovery.jsView on unpkg · L16•matchType = normalized_sha256
matchedPackage = agenticros@0.6.6
matchedPath = dist/util/mcp-discovery.js
matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/util/mcp-discovery.jsView on unpkgdist/commands/init.js#virtual:normalized:round1View file
21import { confirm, input, password, select } from "@inquirer/prompts";
L22: import { execa } from "execa";
L23: import { runDoctorChecks } from "./doctor.js";
Findings
19 High6 Medium6 Low
HighChild Processdist/util/mcp-discovery.js
HighShelldist/commands/init.js#virtual:normalized:round1
HighSame File Env Network Executiondist/util/marketplace.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/util/agy-config.js
HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1
HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz
HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py
HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/commands/web.js
HighKnown Malware Source Similaritydist/util/mcp-discovery.js
Affected versions and remediation
This report applies to agenticros@0.7.35.
See all versions of agenticros for other recorded verdicts.
- Review the evidence and your use of agenticros@0.7.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.