psyclaw@0.25.1
A standalone, evidence-grounded social-science research agent — a conversation-driven agent that bundles the Pi runtime with psyclaw's research contracts, evidence gates, and workflows
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe postinstall hook performs automatic edits inside the package's Pi coding-agent dependency, fitting a guarded agent extension lifecycle warning. Inspected source does not establish unrelated project mutation, credential theft, or another block-eligible attack.
Decision evidence
public snapshot- The postinstall hook runs the package's rebranding script automatically.
- That script locates the installed Pi coding-agent dependency and targets its package metadata and interactive-mode file.
- The script adds PsyClaw Pi configuration and changes matching display strings in that dependency.
- The inspected hook and script show package-aligned rebranding; no unrelated consumer files, credentials, or external endpoints are targeted by this behavior.
- The flagged panel HTML uses local API routes and theme storage in the inspected portions; no suspicious execution primitive was found.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook runs the package's rebranding script automatically.
package.jsonView on unpkg · L44Package ships non-JavaScript build or shell helper files.
scripts/build_preprint_figures.pyView on unpkgFindings
Affected versions and remediation
This report applies to psyclaw@0.25.1.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.25.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.