@agentic-dev.ai/emo@0.1.16
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically sends account-linked activity metrics to its own hub, which qualifies as runtime telemetry carrying identifying details. The flow excludes user content and uses the user's hub authentication, so this warrants a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The server starts while the user is signed in to the hub; reporting repeats every two minutes.
Impact
The hub can associate the user's identity with agent activity and usage metrics. The reported records exclude conversation content.
Mechanism
The reporter uses the user's Firebase ID token to write heartbeats and agent activity metadata to Firestore, with records keyed by the user's email. No telemetry opt-out was found in the inspected code.
AI rationale
The package automatically sends account-linked activity metrics to its own hub, which qualifies as runtime telemetry carrying identifying details. The flow excludes user content and uses the user's hub authentication, so this warrants a warning rather than a malicious verdict.
Evidence
server.mjslib/hub-activity.mjslib/license.mjsEMO_HOME/state/hub-activity.json
Network endpoints1
firestore.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A background reporter starts for valid, signed-in hub users and runs every two minutes.
- It sends authenticated Firestore commits containing heartbeat and activity records associated with the user's email.
- Reported activity includes agent names, action types, status, duration, token counts and coarse tool categories; the source says it excludes prompts and other content.
Evidence against
- The manifest has no install lifecycle hooks; the package exposes a CLI.
- The telemetry is limited to activity metadata, not conversation text, prompts, results or file names.
- The destination is the package's own Firebase hub, and writes use the user's Firebase ID token.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
3 Critical8 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
Medium
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.16.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.