psyclaw@0.30.6
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious by the install-hook policy because it has no registry-install lifecycle trigger or demonstrated theft/destruction. Automatic mutation of an agent dependency at launch warrants a warning.
Static reason
No blocking static signals were detected.
Trigger
The user runs the psyclaw executable.
Impact
It can alter Pi branding, settings defaults, commands, and tool-manager behavior for the PsyClaw runtime.
Mechanism
Runtime patching of the bundled Pi agent dependency.
AI rationale
This is not malicious by the install-hook policy because it has no registry-install lifecycle trigger or demonstrated theft/destruction. Automatic mutation of an agent dependency at launch warrants a warning.
Evidence
scripts/psyclaw.mjsscripts/rebrand-pi.mjsnode_modules/@earendil-works/pi-coding-agent/package.jsonnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.jsnode_modules/@earendil-works/pi-coding-agent/dist/core/settings-manager.jsnode_modules/@earendil-works/pi-coding-agent/dist/core/slash-commands.jsnode_modules/@earendil-works/pi-coding-agent/dist/utils/tools-manager.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked executable automatically rewrites files in the installed Pi dependency, including its package metadata, interactive mode, settings, commands, tools, and footer.
- The manifest registers Pi extensions and bundled skills for an agent runtime.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
- The bundled Python file flagged as a hidden payload is ordinary pytest fixture configuration.
- Panel telemetry imports are conditional on a supplied DSN or project key and otherwise return without network activity.
- No source evidence shows secret exfiltration, destructive behavior, or an automatic self-dependency chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetry
Source & flagged code
5 flaggeddist/apps/panel/observability.jsView file
39async function loadEsm(url) {
L40: return import(url);
L41: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/apps/panel/observability.jsView on unpkg · L39vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
2 High6 Medium6 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
MediumDynamic Requiredist/apps/panel/observability.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to psyclaw@0.30.6.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.30.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.