registry / @agentic-dev.ai/emo / 0.1.23
@agentic-dev.ai/emo@0.1.23
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the reviewed credential flows send service keys to their corresponding services. The CLI does enable startup for EMO after first start, consistent with its app purpose; no unrelated collection or harmful behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the emo CLI or invokes a configured connector; remote access provisioning requires a user request.
Impact
The reviewed behavior supports the package’s stated application features; no unrelated credential transfer or harmful automatic action was found.
Mechanism
Connector credentials are sent to their corresponding services. Remote access uses a user-requested hub flow and runs a Cloudflare tunnel for the local server.
AI rationale
The manifest has no install lifecycle hook, and the reviewed credential flows send service keys to their corresponding services. The CLI does enable startup for EMO after first start, consistent with its app purpose; no unrelated collection or harmful behavior was identified.
Evidence
bin/emo.mjsmcp/sumit.mjslib/remote.mjs
Network endpoints3
api.sumit.co.ilws.shw.co.il:2356github.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines a CLI entry point and has no install, preinstall, or postinstall script.
- The SUMIT connector sends its configured credentials to the matching service at api.sumit.co.il.
- Remote access setup requires a valid user-selected address and a signed-in account before requesting provisioning.
- The CLI’s startup task launches EMO itself after the user starts the app; it is limited to a regular installation.
Evidence against
- The CLI enables its own login startup task on first start unless the user disables it.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltaserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighSemantic Analysis Limitedmcp/sumit.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.23.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.