registry / @agentic-dev.ai/emo
@agentic-dev.ai/emo
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
This report shows the evidence for @agentic-dev.ai/emo@0.1.29. 0 of 27 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1h ago · by lpm-firewall-aiThe flagged credential flows target their own services, while hub activity is limited to metadata and gated on signed-in consent. The CLI's persistence and remote tunnel behavior support EMO's own features, and no install hook or unrelated exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user starts the EMO CLI, signs in, configures an integration, requests a tunnel, or submits a problem report.
Impact
The inspected behavior supports EMO's agent, integration, reporting, and remote-access features. No unrelated credential collection or exfiltration was identified.
Mechanism
Configured service credentials go to their corresponding service; hub activity is limited to usage metadata and gated on sign-in and accepted consent; tunnel setup uses the official cloudflared release.
AI rationale
The flagged credential flows target their own services, while hub activity is limited to metadata and gated on signed-in consent. The CLI's persistence and remote tunnel behavior support EMO's own features, and no install hook or unrelated exfiltration was found.
Evidence
bin/emo.mjsserver.mjsmcp/sumit.mjslib/hub-activity.mjslib/remote.mjs
Network endpoints3
api.sumit.co.ilfirestore.googleapis.comgithub.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and defines only test/build scripts; it has no install lifecycle hook.
- The SUMIT connector sends configured SUMIT credentials to SUMIT's own API host, api.sumit.co.il.
- The hub activity reporter sends whitelisted usage metadata; it is enabled only for a signed-in, non-development install when consent is not pending.
- Problem reports are submitted through an explicit report tool or POST route, and the tool describes the information sent.
- Remote tunnel setup requires an explicit request with a user-chosen slug; the cloudflared binary is downloaded from its official GitHub release host.
Evidence against
- The CLI creates startup persistence after the user starts EMO, and reports that it will start at sign-in; this supports the app's own service.
- The reported activity excludes message content, prompts, results, tool arguments, filenames, email addresses, and phone numbers.
- The flagged high-severity value in hub.json is documented as public Firebase/OAuth client configuration for an installed desktop app.
Behavioral surface
Source & flagged code
12 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
3 Critical6 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/emo.mjs
MediumShips Build Helperwindows/start-emo.cmd
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.29.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.