@agentic-dev.ai/emo@0.1.12
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically sends user prompts and WhatsApp chat history to TypeSafe when its key is configured, without clearly disclosing that content transfer. This warrants a warning for potential data exposure, but the configured decision-service integration does not establish malicious credential theft.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user configures TYPESAFE_API_KEY; subsequent ordinary agent turns and WhatsApp triage invoke the service.
Impact
Private prompts and conversation content may be disclosed to the external service without clear disclosure of the data being sent.
Mechanism
POST requests send message text and, for WhatsApp triage, recent chat history to TypeSafe.
AI rationale
The package automatically sends user prompts and WhatsApp chat history to TypeSafe when its key is configured, without clearly disclosing that content transfer. This warrants a warning for potential data exposure, but the configured decision-service integration does not establish malicious credential theft.
Evidence
server.mjsconnectors.json
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- With TYPESAFE_API_KEY set, server.mjs posts to https://api.typesafe.ai/v1/systemone; JEV_SHADOW=0 is the opt-out.
- The request includes the agent message text, up to 4,000 characters.
- Ordinary non-slash agent turns call the decision function automatically.
- WhatsApp triage sends recent chat history and the inbound message to the same service.
Evidence against
- connectors.json describes Jev as a fast decision service, identifies its API key, and says it is used for automatic model selection.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
15 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical8 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltaserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.12.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.