psyclaw@0.24.0
A standalone, evidence-grounded social-science research agent that bundles Pi with PsyClaw's research contracts, evidence gates, and workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a first-party AI-agent extension with meaningful runtime control surface, so it warrants a warning under policy. Inspection found no unconsented install-time mutation, exfiltration, or payload execution to justify blocking.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Pi loads the declared extensions, or the user invokes `psyclaw setup`, wizard, or MCP-backed features.
Impact
Extends the Pi agent runtime and can modify that runtime's provider configuration after explicit use.
Mechanism
package-owned AI-agent extension with user-invoked provider and MCP integration
AI rationale
This is a first-party AI-agent extension with meaningful runtime control surface, so it warrants a warning under policy. Inspection found no unconsented install-time mutation, exfiltration, or payload execution to justify blocking.
Evidence
package.jsondist/src/cli.jsdist/src/setup.jsdist/src/integrations/mcp.jsdist/src/adapters/pi/rpc.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Manifest declares two package-owned Pi extensions and bundled skills.
- Explicit `setup` command writes Pi provider configuration.
- Pi extension can spawn configured MCP tools at runtime.
Evidence against
- No preinstall/install/postinstall hook; only prepublishOnly is declared.
- Config mutation is reached through explicit CLI setup/wizard flows.
- MCP subprocesses use argument arrays, shell:false, and an explicit environment.
- No source evidence of credential harvesting, stealth persistence, or unconsented exfiltration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsProtestwareUrlStrings
Source & flagged code
4 flaggeddist/src/setup.jsView file
160const entry = fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"));
L161: const { AuthStorage } = await import(pathToFileURL(join(dirname(entry), "core", "auth-storage.js")).href);
L162: const auth = AuthStorage.create(join(agentDir, "auth.json"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/setup.jsView on unpkg · L160dist/src/panel/extension.jsView file
•matchType = normalized_sha256
matchedPackage = psypi@0.3.2
matchedPath = dist/src/panel/extension.js
matchedIdentity = npm:cHN5cGk:0.3.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/src/panel/extension.jsView on unpkgdist/src/adapters/pi/rpc.jsView file
Findings
3 High5 Medium5 Low
HighKnown Malware Source Similaritydist/src/panel/extension.js
HighKnown Malware Source Similaritydist/src/adapters/pi/rpc.js
HighKnown Malware Source Similaritydist/src/integrations/mcp.js
MediumDynamic Requiredist/src/setup.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to psyclaw@0.24.0.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.