psyclaw@0.31.4
A standalone, evidence-grounded social-science research agent with research contracts, evidence gates, and recoverable workflows
AI Security Review
scanned 3d ago · by lpm-firewall-aiDefault runtime telemetry is enabled, but the notice is suppressed in non-interactive runs where telemetry still starts. The inspected payloads omit prompts and completions, so this is a disclosure risk rather than evidence of data theft.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running a PsyClaw CLI command other than help, version, or telemetry while telemetry remains enabled.
Impact
Users running the CLI without a TTY may not see the disclosure before telemetry starts; the data inspected does not include prompts or completions.
Mechanism
The CLI initializes Sentry/PostHog and reports product events, error metadata, and aggregate model usage.
AI rationale
Default runtime telemetry is enabled, but the notice is suppressed in non-interactive runs where telemetry still starts. The inspected payloads omit prompts and completions, so this is a disclosure risk rather than evidence of data theft.
Evidence
dist/src/cli.jsdist/src/observability/preference.jsdist/src/observability/notice.jsdist/src/observability/node-sdks.jsdist/src/observability/llm.js~/.psyclaw/agent/psyclaw-settings.json
Network endpoints2
us.posthog.comcloud.langfuse.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is enabled by default until the user changes the saved preference.
- The CLI suppresses the notice in non-interactive runs, but still initializes telemetry for ordinary commands.
- Telemetry sends error metadata, including error type and potentially redacted paths, to PostHog.
- AI generation events include provider, model, and token usage metadata; prompt and completion fields are omitted.
Evidence against
- An interactive notice describes telemetry and offers a way to turn it off.
- Telemetry can be disabled through the saved preference or PSYCLAW_TELEMETRY=0.
- The inspected AI generation payload excludes prompts and completions.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
6 flaggeddist/apps/panel/observability.jsView file
39async function loadEsm(url) {
L40: return import(url);
L41: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/apps/panel/observability.jsView on unpkg · L39vendor/windows/x64/fd.exeView file
•path = vendor/windows/x64/fd.exe
kind = native_binary
sizeBytes = 4104192
magicHex = [redacted]
Medium
vendor/ars/tools/release-discipline/scripts/sync-toolkit.shView file
Findings
3 High6 Medium6 Low
HighPayload In Excluded Dirvendor/ars/scripts/adapters/tests/conftest.py
HighSemantic Analysis Limiteddist/src/tui/app.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/src/cli.js
MediumDynamic Requiredist/apps/panel/observability.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryvendor/windows/x64/fd.exe
MediumShips Build Helpervendor/ars/tools/release-discipline/scripts/sync-toolkit.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to psyclaw@0.31.4.
See all versions of psyclaw for other recorded verdicts.
- Review the evidence and your use of psyclaw@0.31.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.