@agentic-dev.ai/emo@0.1.0
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Jev shadow feature automatically sends agent message text and metadata to an external service whenever its API key is configured, without clearly disclosing that content transfer. The key requirement and opt-out reduce the risk, but the undisclosed runtime data sharing warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An agent turn while TYPESAFE_API_KEY is configured and JEV_SHADOW is not set to 0.
Impact
User task content and agent metadata may be disclosed to the external service without clearly disclosed consent.
Mechanism
jevShadow posts agent details and message text to api.typesafe.ai for model-selection analysis.
AI rationale
The Jev shadow feature automatically sends agent message text and metadata to an external service whenever its API key is configured, without clearly disclosing that content transfer. The key requirement and opt-out reduce the risk, but the undisclosed runtime data sharing warrants a warning.
Evidence
server.mjsconnectors.json
Network endpoints1
api.typesafe.ai
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When TYPESAFE_API_KEY is set, jevShadow sends agent messages to api.typesafe.ai unless JEV_SHADOW is explicitly set to 0.
- The request includes agent metadata and message text, potentially exposing user task content on each agent turn.
- The connector describes Jev as a quick decision and model-selection service, but does not disclose that message text is sent.
Evidence against
- The Jev call requires a user-configured API key, and can be disabled with JEV_SHADOW=0.
- The package manifest has no install, preinstall, or postinstall hook.
- The flagged SUMIT connector describes its credentials as belonging to SUMIT and sends them to api.sumit.co.il for finance operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
8
Findings
3 Critical8 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellserver.mjs
HighSandbox Evasion Gated Capabilityserver.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
Medium
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.0.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.