@agentic-dev.ai/emo@0.1.5
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has a deliberate TypeSafe integration, but it silently sends free-form messages for shadow evaluation on ordinary turns, beyond the connector's stated automatic model-selection use. This is a runtime privacy risk with unclear consent scope, so it warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A normal agent turn while TYPESAFE_API_KEY is configured; it continues unless JEV_SHADOW=0 is set.
Impact
Private prompts and agent descriptions may be disclosed to the external service beyond the connector's documented automatic-selection use.
Mechanism
The server posts message text and agent information to the Jev endpoint at api.typesafe.ai, even when automatic model selection is not being used.
AI rationale
The package has a deliberate TypeSafe integration, but it silently sends free-form messages for shadow evaluation on ordinary turns, beyond the connector's stated automatic model-selection use. This is a runtime privacy risk with unclear consent scope, so it warrants a warning rather than a publish block.
Evidence
server.mjsconnectors.jsonstate/jev-shadow.jsonl
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- On each non-slash, non-dry agent turn, the server starts Jev shadow evaluation even when the selected model did not already invoke Jev.
- The request sends the user's message text, up to 4,000 characters, and agent details to api.typesafe.ai.
- The shadow request runs whenever TYPESAFE_API_KEY is set unless JEV_SHADOW is explicitly set to 0.
- The connector describes Jev as a quick-decision service used for automatic model selection; it does not disclose shadow evaluation of every message.
Evidence against
- Jev is an intentional product integration, and the code sends requests to its configured service using the user's TypeSafe API key.
- The manifest has no install, preinstall, or postinstall script; the behavior is runtime-only.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
8
Findings
4 Critical8 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltaserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellserver.mjs
HighSandbox Evasion Gated Capabilityserver.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.5.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.