psyclaw@0.30.0
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has an explicit user-triggered agent-runtime mutation surface but no automatic registry-install hook or concrete malicious behavior. Downgrade to a warning for its guarded first-party extension lifecycle risk.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs the psyclaw executable.
Impact
It changes behavior of the bundled agent runtime and can expose user-approved agent installation functions.
Mechanism
Runtime rewriting of the bundled Pi agent configuration and modules.
AI rationale
The package has an explicit user-triggered agent-runtime mutation surface but no automatic registry-install hook or concrete malicious behavior. Downgrade to a warning for its guarded first-party extension lifecycle risk.
Evidence
scripts/psyclaw.mjsscripts/rebrand-pi.mjsdist/src/chat.jsdist/src/tui/app.js
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the CLI automatically patches the bundled Pi runtime and configures its agent directory.
- The rebrand routine rewrites several files in the bundled agent dependency, including command and settings components.
- The TUI can execute an agent install only after an interactive Y confirmation.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
- The flagged Python file is a conventional pytest fixture and contains no payload behavior.
- No secret exfiltration, self-dependency, or unconsented install-time network execution was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsProtestwareTelemetryUrlStrings
Source & flagged code
6 flaggeddist/apps/panel/observability.jsView file
38async function loadEsm(url) {
L39: return import(url);
L40: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/apps/panel/observability.jsView on unpkg · L38vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
3 High7 Medium6 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltascripts/rebrand-pi.mjs
MediumDynamic Requiredist/apps/panel/observability.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to psyclaw@0.30.0.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.