psyclaw@0.29.12
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious under the install-hook boundary because no automatic npm installation hook exists. Its automatic mutation of a bundled agent runtime is nevertheless a concrete extension lifecycle risk that warrants a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
User runs the psyclaw CLI.
Impact
Changes Pi branding, defaults, and command availability for the PsyClaw runtime.
Mechanism
Automatic runtime patching of a bundled AI-agent dependency.
AI rationale
The package is not malicious under the install-hook boundary because no automatic npm installation hook exists. Its automatic mutation of a bundled agent runtime is nevertheless a concrete extension lifecycle risk that warrants a warning.
Evidence
scripts/psyclaw.mjsscripts/rebrand-pi.mjs
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked launcher automatically calls a runtime rebranding routine.
- That routine rewrites the bundled Pi dependency's package metadata, UI code, settings default, and slash-command code.
- The runtime changes hide Pi login and logout commands and alter its default settings.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No self-dependency on psyclaw is declared.
- Networked update and install behavior is exposed through explicit CLI commands.
- The MCP transport uses argument-vector spawning with an empty-by-default environment.
- ARS input rejects sensitive filenames and apparent credentials before processing.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsProtestwareUrlStrings
Source & flagged code
7 flaggeddist/src/network-routing.jsView file
170const managerUrl = new URL("./utils/tools-manager.js", entryHref);
L171: const manager = await import(managerUrl.href);
L172: const failures = [];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/network-routing.jsView on unpkg · L170vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
4 High7 Medium5 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/integrations/mcp.js
HighPrevious Version Dangerous Deltadist/src/ars/bridge.js
MediumDynamic Requiredist/src/network-routing.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to psyclaw@0.29.12.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.29.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.