registry / @agentic-dev.ai/emo / 0.1.9
@agentic-dev.ai/emo@0.1.9
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package provides a local AI-agent command center with service integrations; the inspected network and credential flows match that purpose. It enables launch-at-sign-in on the first normal start, and user-submitted problem reports may include logs, but neither behavior shows an undisclosed attack in the reviewed source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user starts EMO or invokes an integration or problem-report action.
Impact
No unauthorized credential transfer or other malicious behavior was found in the reviewed flows.
Mechanism
The CLI starts a local server and connectors send configured credentials to their corresponding service APIs. Problem reports are submitted through an explicitly described report action.
AI rationale
The package provides a local AI-agent command center with service integrations; the inspected network and credential flows match that purpose. It enables launch-at-sign-in on the first normal start, and user-submitted problem reports may include logs, but neither behavior shows an undisclosed attack in the reviewed source.
Evidence
bin/emo.mjsserver.mjslib/license.mjsmcp/sumit.mjs
Network endpoints4
api.sumit.co.ilfirestore.googleapis.comsecuretoken.googleapis.comwww.googleapis.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines test and build scripts but no install lifecycle hook.
- The send_report tool describes sending a problem report when the user says something is broken, including system details and recent logs.
- The report is saved locally and sent to the hub only when a hub session exists; its source says it excludes conversation content.
- SUMIT credentials are sent in requests to the declared SUMIT API host, api.sumit.co.il.
Evidence against
- On the first normal start, the CLI enables launch-at-sign-in persistence unless the user has disabled it or is using a test, development, or npx copy.
- A submitted problem report can include up to 400 recent log lines and identifying account details.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltaserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
Medium
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.9.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.