agenticros@0.7.36

⚠ Under review

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

The inspected manifest and agent setup excerpts do not establish malicious behavior; the setup prompt gates the OpenClaw plugin installation. The shipped runtime archive remains materially unresolved because its offline inspection failed, so manual review is warranted.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The archive's runtime trigger could not be determined from the available inspection.

Impact

The unresolved archive prevents a confident package-wide verdict.

Mechanism

The offline archive analysis stopped at a TAR entry limit or missing terminator, so its contents and callers could not be resolved.

AI rationale

Evidence

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgz.lpm-inspection-sR8xhf/0-be34d918abd7.txt

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json has no preinstall, install, or postinstall hook; its prepublishOnly script runs build and packaging checks.
OpenClaw plugin installation is offered during the init command and proceeds only after a confirmation prompt.
The required offline analysis for the shipped runtime archive reports that inspection failed because of a TAR entry limit or missing complete terminator.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 284 file(s), 2.07 MB of source, external domains: 127.0.0.1, ai.google.dev, aistudio.google.com, antigravity.google, api.github.com, claude.com, cloud.agenticros.com, corebrum.com, developers.openai.com, docs.ros.org, github.com, host.openshell.internal, huggingface.co, nodejs.org, skills.agenticros.com

Source & flagged code

24 flagged

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = dist/util/mcp-discovery.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

High

Shell

Package source references shell execution.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L21

56// strips .npmrc from the published tarball, so we can"t ship it - and even\n // workspace-mode users benefit from having strict-peer-dependencies=false\n // for the init flo... L57: // in .bin" purgatory.\n if (opts.force || !isWorkspaceInstalled(repoRoot)) {\n if (!hasBin("pnpm")) {\n err("pnpm is not installed (or not on PATH). `agenticr... L58: // src/ but install/ is from the previous CLI version" case - without\n // it, init's sk[redacted] logic ships users a\n // stale install dir (e.g. 0.1.10 adde...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.js#virtual:normalized:round1View on unpkg · L56

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/init.js#virtual:normalized:round1View on unpkg

dist/util/workspace.jsView file

112for (const from of requireFrom) { L113: const req = createRequire(from); L114: for (const pkg of candidates) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/util/workspace.jsView on unpkg · L112

dist/util/marketplace.jsView file

3* L4: * The marketplace itself is at https://sk[redacted] — this CLI L5: * talks to the REST endpoints exposed under /api/ (rewritten by Firebase ... L12: import { dirname, basename, join, resolve } from "node:path"; L13: import { execa } from "execa"; L14: import { discoveryRoots } from "./skills.js"; ... L16: export function apiBase() { L17: return (process.env.AGENTICROS_SKILLS_API || DEFAULT_API_BASE).replace(/\/+$/, ""); L18: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/util/marketplace.jsView on unpkg · L3

dist/util/agy-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, isabsolute, join, resolve } from "node:path"; const agenticros_server_key = "agenticros"; export function globalagymcpconfigpath() { return join(homedir(), ".gemini", "config", "mcp_config.json"); } export function projectagymcpconfigpath(cwd = process.cwd()) { return join(cwd, ".agents", "mcp_config.json"); } export function globalagyskillpath() { return j

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/util/agy-config.jsView on unpkg

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3560 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView file

•path = runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.py kind = payload_in_excluded_dir sizeBytes = 2122 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

runtime/ros2_ws/src/agenticros_explore/test/test_frontiers.pyView on unpkg

dist/commands/web.jsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.9 matchedPath = dist/commands/web.js matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/web.jsView on unpkg

runtime/scripts/agenticros-proxy.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/agenticros-proxy.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/agenticros-proxy.cjsView on unpkg

runtime/scripts/openclaw-dashboard-url.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/openclaw-dashboard-url.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/openclaw-dashboard-url.cjsView on unpkg

runtime/scripts/setup-openclaw-local.cjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/setup-openclaw-local.cjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/setup-openclaw-local.cjsView on unpkg

runtime/packages/agenticros-claude-code/yolo-debug.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/packages/agenticros-claude-code/yolo-debug.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/packages/agenticros-claude-code/yolo-debug.mjsView on unpkg

runtime/scripts/check-cli-tarball-size.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/check-cli-tarball-size.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/check-cli-tarball-size.mjsView on unpkg

runtime/scripts/smoke_test_nemoclaw.shView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/smoke_test_nemoclaw.sh matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/smoke_test_nemoclaw.shView on unpkg

runtime/scripts/test-follow-me-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-follow-me-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-follow-me-sim.mjsView on unpkg

runtime/scripts/test-mcp-e2e.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-mcp-e2e.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-mcp-e2e.mjsView on unpkg

runtime/scripts/test-navigate-sim.mjsView file

•matchType = normalized_sha256 matchedPackage = agenticros@0.6.6 matchedPath = runtime/scripts/test-navigate-sim.mjs matchedIdentity = npm:YWdlbnRpY3Jvcw:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/scripts/test-navigate-sim.mjsView on unpkg

runtime/packages/agenticros-robot/comms.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agenticros@0.7.35 matchedIdentity = npm:YWdlbnRpY3Jvcw:0.7.35 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/packages/agenticros-robot/comms.jsView on unpkg

Source & flagged code

24 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/mcp-discovery.jsView on unpkg

dist/commands/init.js#virtual:normalized:round1View file

21import { confirm, input, password, select } from "@inquirer/prompts"; L22: import { execa } from "execa"; L23: import { runDoctorChecks } from "./doctor.js";

Findings

1 Critical19 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltaruntime/packages/agenticros-robot/comms.js

HighChild Processdist/util/mcp-discovery.js

HighShelldist/commands/init.js#virtual:normalized:round1

HighSame File Env Network Executiondist/util/marketplace.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/util/agy-config.js

HighRuntime Package Installdist/commands/init.js#virtual:normalized:round1

HighShips High Entropy Blobruntime/packages/agenticros/agenticros-agenticros-0.0.1.tgz

HighPayload In Excluded Dirruntime/ros2_ws/src/agenticros_explore/test/test_frontiers.py

HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1

High

Affected versions and remediation

This report applies to agenticros@0.7.36.

See all versions of agenticros for other recorded verdicts.

Review the evidence and your use of agenticros@0.7.36 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 16:17:45.800Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.