psyclaw@0.29.15
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo malicious lifecycle hook or concrete exfiltration behavior was found. The package nevertheless has explicit user-triggered agent-control and subprocess capabilities, so it should be warned rather than marked clean under the stated policy.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user launches the PsyClaw TUI and confirms an install or imports content, or configures and invokes an MCP tool.
Impact
A user-approved action can modify local agent content or run the configured tool command.
Mechanism
Explicit agent-management and configured MCP subprocess execution.
AI rationale
No malicious lifecycle hook or concrete exfiltration behavior was found. The package nevertheless has explicit user-triggered agent-control and subprocess capabilities, so it should be warned rather than marked clean under the stated policy.
Evidence
package.jsondist/src/tui/app.jsdist/src/integrations/mcp.js.psyclaw/imports
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package registers Pi extensions and exposes agent-management functions.
- The TUI can run an installation workflow only after the user presses y.
- Its MCP transport can launch a configured subprocess command.
- The flagged Python file is ordinary pytest fixture code, not an executable payload.
Evidence against
- package.json has no preinstall, install, or postinstall hook; prepublishOnly is publish-time only.
- The TUI uses shell:false for its subprocess runner.
- The MCP subprocess launcher supplies an explicit environment rather than inheriting process.env.
- No source inspected showed credential exfiltration, destructive actions, or automatic persistence.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsProtestwareUrlStrings
Source & flagged code
6 flaggeddist/src/network-routing.jsView file
170const managerUrl = new URL("./utils/tools-manager.js", entryHref);
L171: const manager = await import(managerUrl.href);
L172: const failures = [];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/network-routing.jsView on unpkg · L170vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
3 High7 Medium5 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/integrations/mcp.js
MediumDynamic Requiredist/src/network-routing.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to psyclaw@0.29.15.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.29.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.