psyclaw@0.30.5
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not shown to be malicious, but it contains explicit user-invoked functionality that installs other agents and changes agent configuration. Treat it as a dangerous agent-management capability requiring a warning rather than an automatic block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user launches the PsyClaw TUI and presses Y at an install or provider-setup prompt.
Impact
A confirmed action can execute an external agent install command or alter the PsyClaw agent's authentication and model files.
Mechanism
User-approved agent installation and agent configuration mutation.
AI rationale
The package is not shown to be malicious, but it contains explicit user-invoked functionality that installs other agents and changes agent configuration. Treat it as a dangerous agent-management capability requiring a warning rather than an automatic block.
Evidence
package.jsondist/src/tui/app.jsdist/src/setup.js.psyclaw/agent/auth.json.psyclaw/agent/models.json.psyclaw/installs.jsonl
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest registers three Pi agent extensions, creating an agent-extension execution surface.
- The interactive TUI runs a discovered agent's install command only after the user presses Y.
- Provider setup can write an API key to the isolated agent authentication store and modify its model catalog.
- The flagged vendored Python file is executable test-fixture code, adding bundled code surface but showing no payload behavior.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
- The reviewed agent installation and skill import paths require an interactive confirmation.
- No reviewed source sends credentials or collected files to a network endpoint, and the test fixture only defines pytest helpers.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/apps/panel/observability.jsView file
39async function loadEsm(url) {
L40: return import(url);
L41: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/apps/panel/observability.jsView on unpkg · L39vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
3 High6 Medium6 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/src/setup.js
MediumDynamic Requiredist/apps/panel/observability.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to psyclaw@0.30.5.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.30.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.