psyclaw@0.25.2
A standalone, evidence-grounded social-science research agent — a conversation-driven agent that bundles the Pi runtime with psyclaw's research contracts, evidence gates, and workflows
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe postinstall behavior is limited in the inspected source to branding the bundled Pi runtime through its package metadata and display strings. No unrelated control-surface mutation, credential forwarding, or other concrete attack behavior was established.
Decision evidence
public snapshot- The package runs a rebranding helper during postinstall.
- The helper writes branding configuration and display-string changes into the installed @earendil-works/pi-coding-agent dependency.
- The helper resolves that dependency and targets its package metadata and interactive-mode file; no unrelated control-surface write or exfiltration is established.
- The helper's observed changes are limited to package branding configuration and interactive display strings.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs a rebranding helper during postinstall.
package.jsonView on unpkg · L45Package ships non-JavaScript build or shell helper files.
scripts/build_preprint_figures.pyView on unpkgFindings
Affected versions and remediation
This report applies to psyclaw@0.25.2.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.25.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.