registry / @agentic-dev.ai/emo / 0.1.21
@agentic-dev.ai/emo@0.1.21
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package is a local AI team application with a CLI, configured service connectors, and optional remote access. The flagged credential and download flows target the corresponding services, while the reviewed hub reporting is restricted to usage metadata.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI starts the local service; configured connectors and remote access operate when enabled or used.
Impact
The reviewed behavior supports accounting, remote access, and usage reporting; no unrelated credential theft or concealed execution was found.
Mechanism
Configured credentials go to their named services, Cloudflare's tunnel binary is downloaded from its official release path, and hub reporting is limited to usage metadata.
AI rationale
The package is a local AI team application with a CLI, configured service connectors, and optional remote access. The flagged credential and download flows target the corresponding services, while the reviewed hub reporting is restricted to usage metadata.
Evidence
EMO_HOME/bin/cloudflaredEMO_HOME/state/cloudflared/EMO_HOME/state/remote.json~/Library/LaunchAgents/ai.agentic-dev.emo.plistEMO_HOME/state/autostart.json
Network endpoints2
api.sumit.co.ilgithub.com/cloudflare/cloudflared/releases/latest/download/
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has only test and build scripts; it declares no install lifecycle hook.
- The SUMIT connector sends configured account credentials to SUMIT's own API for its accounting feature.
- The remote feature downloads cloudflared from Cloudflare's official GitHub release path.
- Hub activity reporting is described as a whitelist of usage metadata, excluding message text, prompts, results, filenames, and tool arguments.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
13 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
3 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighSemantic Analysis Limitedmcp/sumit.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/emo.mjs
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.21.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.