@agentic-dev.ai/emo@0.1.15
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe optional Jev integration is identifiable and its stated purpose involves judging messages, but the server also sends ordinary messages for shadow analysis when a fixed model is used. This makes the prompt transfer broader than the connector description clearly conveys, so warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Runtime message handling when TYPESAFE_API_KEY is configured; JEV_SHADOW=0 disables the shadow path.
Impact
Conversation content may be disclosed to TypeSafe beyond the model-selection cases apparent from the connector description.
Mechanism
Posts message text and, for WhatsApp classification, recent conversation context to https://api.typesafe.ai/v1/systemone.
AI rationale
The optional Jev integration is identifiable and its stated purpose involves judging messages, but the server also sends ordinary messages for shadow analysis when a fixed model is used. This makes the prompt transfer broader than the connector description clearly conveys, so warn rather than block.
Evidence
server.mjsconnectors.jsonstate/jev-shadow.jsonl
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The optional Jev connector is described as a fast judge and model-selection feature, and requires a user-supplied API key.
- When TYPESAFE_API_KEY is set, server.mjs sends message text, up to 4,000 characters, to api.typesafe.ai; JEV_SHADOW=0 disables this path.
- The server invokes Jev for nonslash messages even when model selection is not automatic, so ordinary conversation text can be sent for shadow analysis.
- The WhatsApp judge sends conversation context and recent messages to the same endpoint when the key is configured.
Evidence against
- The manifest has no install, preinstall, or postinstall script.
- The Jev integration is optional and explicitly named in the connector settings; its stated purpose involves judging questions and model selection.
- The source does not show this path sending credentials or files, and the service request uses the configured Typesafe key.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
15 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical8 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltalib/future-content.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.15.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.