@agentic-dev.ai/emo@0.1.13
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThis is a user-run AI command center with no install hook, but it enables identifiable activity telemetry by default after hub sign-in. The payload is limited to metadata and goes to the product's own service, so this warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Automatically after hub sign-in while the server runs; the reporter ticks every two minutes.
Impact
The hub can associate the user's account with agent names, action types, usage counts, durations, and token counts.
Mechanism
The reporter uses the signed-in user's Firebase identity to write heartbeat and per-run metadata to the product's Firestore database.
AI rationale
This is a user-run AI command center with no install hook, but it enables identifiable activity telemetry by default after hub sign-in. The payload is limited to metadata and goes to the product's own service, so this warrants a warning rather than a publish block.
Evidence
server.mjslib/hub-activity.mjslib/license.mjsEMO_HOME/state/hub-activity.json
Network endpoints2
firestore.googleapis.comsecuretoken.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After hub sign-in, the activity reporter is enabled for licensed, non-development installs by default; no opt-out check appears in this gate.
- The reporter starts automatically on a two-minute interval.
- It sends heartbeat counts and version data to Firestore under the signed-in user's account.
- Per-run events include agent ID and name, action kind and status, duration, token count, and tool-category counts.
Evidence against
- package.json has no install, preinstall, or postinstall script.
- The reporter sends a bounded metadata record; the inspected event fields do not include prompts, messages, tool arguments, or results.
- The external reporting destination is the product's own Firebase Firestore service; no unrelated collector was identified in this flow.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
15 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical8 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltalib/remote.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.13.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.