psyclaw@0.30.1
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious behavior or install hook was found, but automatic runtime patching of a bundled coding-agent dependency warrants a warning. The source supports a bounded agent-extension risk rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
Running the psyclaw command.
Impact
Changes bundled agent configuration, UI behavior, and available commands; no secret theft or external control-surface write was confirmed.
Mechanism
Runtime patching of a bundled agent dependency.
AI rationale
No concrete malicious behavior or install hook was found, but automatic runtime patching of a bundled coding-agent dependency warrants a warning. The source supports a bounded agent-extension risk rather than a publish block.
Evidence
scripts/psyclaw.mjsscripts/rebrand-pi.mjspackage.jsonnode_modules/@earendil-works/pi-coding-agent/package.jsonnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.jsnode_modules/@earendil-works/pi-coding-agent/dist/core/settings-manager.jsnode_modules/@earendil-works/pi-coding-agent/dist/core/slash-commands.jsnode_modules/@earendil-works/pi-coding-agent/dist/utils/tools-manager.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest registers three Pi extension entrypoints.
- Running the psyclaw command automatically invokes a rebranding routine before loading the CLI.
- That routine rewrites the bundled Pi package metadata and several runtime JavaScript files.
Evidence against
- package.json has only a prepublishOnly script and no install-time lifecycle hook.
- The agent installer and importer require an explicit confirmation action.
- The high-severity Python finding is ordinary pytest fixture code, not a payload.
- No credential contents, secret exfiltration, or unconsented network execution was found in the inspected paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsProtestwareTelemetryUrlStrings
Source & flagged code
5 flaggeddist/apps/panel/observability.jsView file
38async function loadEsm(url) {
L39: return import(url);
L40: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/apps/panel/observability.jsView on unpkg · L38vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
2 High7 Medium6 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
MediumDynamic Requiredist/apps/panel/observability.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to psyclaw@0.30.1.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.30.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.