psyclaw@0.29.18
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains meaningful user-invoked agent-control and telemetry capabilities, so it warrants a warning. Source inspection found no install hook, self-dependency chain, hidden payload, or concrete malicious behavior.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs psyclaw or submits an approved installation request through its local panel.
Impact
A user-approved panel action can execute a catalog command; the launched agent has write and shell capabilities, and telemetry metadata can leave the machine.
Mechanism
User-invoked AI-agent control, shell execution, settings mutation, and telemetry.
AI rationale
The package contains meaningful user-invoked agent-control and telemetry capabilities, so it warrants a warning. Source inspection found no install hook, self-dependency chain, hidden payload, or concrete malicious behavior.
Evidence
dist/src/chat.jsdist/src/panel/server.jsdist/src/observability/preference.jsdist/src/observability/node-sdks.jsscripts/rebrand-pi.mjs.psyclaw
Network endpoints2
us.posthog.como4512050300911616.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The launch path replaces the underlying agent identity and enables file-write and shell tools.
- Telemetry is enabled by default and sends CLI events to vendor telemetry services.
- The local panel can execute catalog-derived shell commands after a request-provided approval flag.
- The panel writes settings in the agent runtime directory.
- MCP can launch configured child processes, although it uses an empty environment and disables shell execution.
- The scanner-marked Python file is a normal pytest fixture, not an embedded payload.
Evidence against
- package.json has only a prepublish-only hook, not an install lifecycle hook.
- No self-dependency on psyclaw was found.
- The TUI requires an explicit Y confirmation before agent installation or skill import.
- The MCP transport clears inherited environment variables and uses shell false.
- No credential harvesting, opaque payload loading, destructive action, or reviewer-directed package text was found.
- The bundled test fixture only defines local test helpers.
Behavioral surface
Source & flagged code
7 flaggeddist/apps/panel/observability.jsView file
38async function loadEsm(url) {
L39: return import(url);
L40: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/apps/panel/observability.jsView on unpkg · L38vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
4 High7 Medium6 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/integrations/mcp.js
HighPrevious Version Dangerous Deltadist/src/chat.js
MediumDynamic Requiredist/apps/panel/observability.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to psyclaw@0.29.18.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.29.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.