@agentic-dev.ai/emo@0.1.11
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically reports identifiable, account-linked usage metadata after sign-in, without a visible disclosure or opt-out in the inspected UI and README. The payload is limited to activity metadata rather than prompts or content, so this is suspicious telemetry rather than data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The server starts after a user signs in to the hub.
Impact
The hub can associate the user's account with agent activity, usage timing and token counts. The inspected sign-in UI and README do not disclose this reporting or provide a control to disable it.
Mechanism
A recurring reporter posts activity summaries and per-action metadata using the user's Firebase token; its local cursor is stored in EMO_HOME/state/hub-activity.json.
AI rationale
The package automatically reports identifiable, account-linked usage metadata after sign-in, without a visible disclosure or opt-out in the inspected UI and README. The payload is limited to activity metadata rather than prompts or content, so this is suspicious telemetry rather than data exfiltration.
Evidence
server.mjslib/hub-activity.mjslib/license.mjsEMO_HOME/state/hub-activity.jsonFirestore users/{email}Firestore activity/{email}/days/{YYYY-MM-DD}Firestore activity/{email}/events/{id}
Network endpoints2
firestore.googleapis.comsecuretoken.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A signed-in production instance automatically starts the activity reporter with the account email, run log and a refreshed account token.
- The reporter sends a heartbeat every two minutes and retries activity on later ticks.
- Reported activity includes timestamps, agent IDs and names, action types, status, duration, token counts and tool categories.
- The reporter posts authenticated Firestore commits to the hub, with activity documents scoped to the signed-in user.
Evidence against
- The activity reporter is gated to licensed, signed-in, non-development instances.
- The reporter uses a field whitelist that excludes prompts, answers, conversation content, file names and tool arguments.
- package.json declares no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
3 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/emo.mjs
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.11.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.