psyclaw@0.29.14
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install-time behavior or exfiltration was found. The package nevertheless activates a broad agent runtime and delegates tool installation to opaque dependency code during normal use, so it warrants a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user runs the PsyClaw chat command or explicitly confirms an agent installation.
Impact
A user-invoked session can execute configured tools and make package-management or GitHub requests; the exact downloader implementation is not shipped in this package.
Mechanism
Runtime agent extension loading with dependency-managed tool acquisition.
AI rationale
No concrete malicious install-time behavior or exfiltration was found. The package nevertheless activates a broad agent runtime and delegates tool installation to opaque dependency code during normal use, so it warrants a warning.
Evidence
dist/src/network-routing.jsdist/src/chat.jsdist/src/integrations/mcp.jsdist/src/tui/app.js
Network endpoints6
gh-proxy.comgh-proxy.orgregistry.npmmirror.comregistry.npmjs.orgapi.github.comgithub.com
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package declares Pi extensions and bundled skills, creating an agent-extension execution surface.
- A chat launch enables a preload that dynamically imports the bundled Pi tool manager and requests fd and rg; the acquisition behavior is outside this package's visible source.
- The MCP integration spawns configured commands with an empty default environment, disables shell parsing, and defaults effects to read-only.
- The flagged TUI installer requires an interactive Y confirmation, and the flagged Python file is only a test fixture.
Evidence against
- package.json has only a prepublishOnly script, not an install lifecycle hook.
- No self-dependency is declared.
- No credential harvesting or concrete exfiltration path was found in the inspected sources.
- No unconsented broad foreign agent-config mutation was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/src/network-routing.jsView file
170const managerUrl = new URL("./utils/tools-manager.js", entryHref);
L171: const manager = await import(managerUrl.href);
L172: const failures = [];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/network-routing.jsView on unpkg · L170vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
3 High7 Medium5 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/integrations/mcp.js
MediumDynamic Requiredist/src/network-routing.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to psyclaw@0.29.14.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.29.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.