@agentic-dev.ai/emo@0.1.28
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe package’s main behavior appears consistent with its stated desktop-agent purpose, and the flagged credential flows inspected are tied to their configured services. However, a normal first start enables login persistence even though the README presents it as an explicit command, so warn users about that automatic behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
First normal `emo start`, when the autostart flag is absent.
Impact
EMO continues running after future logins until autostart is disabled.
Mechanism
The CLI calls its autostart routine, which configures a scheduled task or LaunchAgent to run EMO at login.
AI rationale
The package’s main behavior appears consistent with its stated desktop-agent purpose, and the flagged credential flows inspected are tied to their configured services. However, a normal first start enables login persistence even though the README presents it as an explicit command, so warn users about that automatic behavior.
Evidence
bin/emo.mjsWindows scheduled task Agentic-dev-EMO~/Library/LaunchAgents/ai.agentic-dev.emo.plist
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On a normal first start, the CLI enables autostart unless an autostart flag file exists or a limited set of environment conditions applies.
- The README describes autostart as an explicit `emo autostart on` command, but the normal first-start path enables it automatically.
- Autostart writes a login task or LaunchAgent that runs the EMO server.
Evidence against
- The persistence starts the package’s own server, consistent with its desktop-agent purpose.
- The SUMIT connector sends credentials to the SUMIT API endpoint, and problem reports are sent through the user’s authenticated product account.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
13 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical6 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltalib/remote.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/emo.mjs
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.28.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.