psyclaw@0.29.10
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-signal files contain ordinary CLI, MCP, and test-fixture code, while the manifest lacks automatic install hooks and a self-dependency. The package has potentially powerful user-invoked agent features, but source inspection found no concrete malicious chain.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the psyclaw CLI or confirms an action in its TUI.
Impact
No unconsented install-time mutation, secret exfiltration, or remote payload execution was found.
Mechanism
User-invoked research-agent runtime and optional tool setup.
AI rationale
The high-signal files contain ordinary CLI, MCP, and test-fixture code, while the manifest lacks automatic install hooks and a self-dependency. The package has potentially powerful user-invoked agent features, but source inspection found no concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has only a publish-time hook, not an install-time hook.
- The MCP transport can run a configured local command, but uses argument arrays, disables the shell, and defaults to an empty environment.
- The chat command starts the bundled runtime after the user runs the CLI.
- The TUI runs agent installation only after an explicit Y confirmation.
- The flagged Python file is a pytest fixture module with YAML helper functions, not a payload loader.
- The runtime preload can configure routing and ensure search tools only when launched with its explicit preload flag.
Evidence against
- No preinstall, install, or postinstall lifecycle script is present.
- No dependency on psyclaw itself is declared.
- No source evidence of credential harvesting or exfiltration was found.
- Agent changes are tied to explicit CLI or TUI actions rather than package installation.
- The MCP integration denies untrusted servers and requires approval for non-read effects.
Behavioral surface
ChildProcessCrypto
Source & flagged code
7 flaggeddist/src/network-routing.jsView file
168const managerUrl = new URL("./utils/tools-manager.js", piEntry);
L169: const manager = await import(managerUrl.href);
L170: const failures = [];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/network-routing.jsView on unpkg · L168vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
4 High7 Medium5 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/integrations/mcp.js
HighPrevious Version Dangerous Deltadist/src/chat.js
MediumDynamic Requiredist/src/network-routing.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to psyclaw@0.29.10.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.29.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.