registry / @aisystemresources/emdee / 0.24.9

@aisystemresources/emdee@0.24.9

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The automatic postinstall copy into Claude Code's skills directory is a concrete agent extension lifecycle risk and warrants a warning. The inspected authentication flow uses an OAuth code exchange with the configured host, and no separate attack chain was established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Package installation runs the postinstall hook, unless EMDEE_SKIP_POSTINSTALL is set to 1.

Impact

Package-provided skills become available to Claude Code without a separate explicit install command.

Mechanism

The hook launches the bundled installer, which copies Markdown skill files from the package into ~/.claude/skills by default.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/cli/skills-install.js~/.claude/skills

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall hook automatically invokes its bundled skill installer, unless an environment opt-out is set.
The installer defaults to the user's Claude Code skills directory and copies package-supplied Markdown skill files there.
The inspected bundled MCP server location lists Claude-related package files; it does not itself establish another configuration write.

Evidence against

The inspected authentication code exchanges a user-authorized OAuth code with the configured service host; no credential forwarding to an unrelated recipient was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 124 file(s), 5.55 MB of source, external domains: 127.0.0.1, emdee.tech, example.com, foo.bar, github.com, www.w3.org

Source & flagged code

15 flagged

package.jsonView file

Lines 11-51json

11 "emdee": "bin/emdee.js"

12 },

13 "publishConfig": {

14 "access": "public"

15 },

16 "scripts": {

17 "dev": "next dev --webpack",

18 "build": "next build --webpack",

19 "start": "next start",

20 "lint": "eslint",

21 "mcp": "tsx src/mcp/server.ts",

22 "typecheck": "tsc --noEmit",

23 "test:context": "node --import tsx --test scripts/test-context-startup.ts scripts/test-context-tools.ts",

24 "e2e": "playwright test",

25 "e2e:ui": "playwright test --ui",

26 "e2e:report": "playwright show-report",

27 "check:migrations": "node scripts/check-migration-drift.mjs",

28 "ci-package": "node scripts/verify-package.mjs",

29 "build:cli": "node scripts/build-cli.mjs",

30 "prepublishOnly": "node scripts/build-cli.mjs",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test:access": "node --import tsx --test scripts/test-agent-access.ts scripts/test-oauth-consent.ts scripts/test-admin-access.ts scripts/test-admin-metrics.ts scripts/test-publication-scope.ts scripts/test-publication-rename.ts scripts/test-pdf-export.ts",

33 "test:knowledge": "node --import tsx --test scripts/test-knowledge.ts",

34 "benchmark:context": "node --import tsx scripts/benchmark-context.ts",

35 "test:discovery": "node --import tsx --test scripts/test-discovery.ts",

36 "test:discovery:database": "node --import tsx --test scripts/test-discovery-database.ts",

37 "verify:discovery:ui": "node scripts/discovery-ui-fixture.mjs",

38 "test:plugin": "node --import tsx --test scripts/test-public-plugin.ts",

39 "build:plugin": "node scripts/build-public-plugin.mjs"

40 },

41 "files": [

42 "bin/",

43 "dist/",

44 "scripts/postinstall.mjs",

45 "src/cli/",

46 "src/core/",

47 "src/lib/cache/",

48 "src/lib/discovery/",

49 "src/lib/database/",

50 "src/lib/mcp/",

51 "src/lib/storage/",

bin/emdee.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import { spawn, spawnSync } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

dist/mcp/server.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg

18function adminClient() { L19: const key = process.env.SUPABASE_SECRET_KEY ?? process.env.SUPABASE_SERVICE_ROLE_KEY; L20: return createClient( ... L1114: const admin = adminClient(); L1115: const { data: direct } = await admin.from("doc_shares").select("id, share_root").eq("grantee_id", granteeId).eq("owner_id", ownerId).eq("path_prefix", relPath).eq("permission", "wr... L1116: if (direct && isWithinShareRootBoundary(relPath, direct.share_root)) return true; ... L1895: { "name": "get_image", "description": "Fetch an image from the vault and return it as a visual content block so you can see and analyze it. Use this to label images (patch_preamble... L1896: { "name": "upload_image", "description": "Upload an image (jpg/png/gif/webp/svg) as base64 to the vault. Creates a markdown doc tha

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp/server.jsView on unpkg · L18

dist/cli/auth-commands.jsView file

Lines 1-26javascript

1// src/cli/auth-commands.ts

2import { parseArgs } from "node:util";

4// src/cli/auth.ts

5import { createHash, randomBytes } from "node:crypto";

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises";

src/cli/auth.tsView file

Lines 1-32typescript

1// SPRINT-091: CLI auth — PKCE loopback OAuth against emdee.tech.

2//

3// Follows RFC 8252 (OAuth 2.0 for native apps) + dynamic client registration

4// via /oauth/register (matches Codex + Claude Code patterns already in use).

5// Credentials land in ~/.config/emdee/credentials.json at 0600.

6//

7// Token has a 30-day TTL and there is no refresh grant on the server today,

8// so credentials are simple: access_token + client_id + host + saved_at. When

9// a token expires, the CLI surfaces `run 'emdee login'` — same UX as Codex.

dist/cli/skills-install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { readdir, mkdir, copyfile, stat } from "node:fs/promises"; import { parseargs } from "node:util"; import path from "node:path"; import os from "node:os"; import { fileurltopath } from "node:url"; var default_target = path.join(os.homedir(), ".claude", "skills"); var pkg_root = path.resolve(path.dirname(fileurltopath(import.meta.url)), "..", ".."); var skills_src = path.join(pkg_root, "skills"); async function copydirrecursive(srcdir, destdir) { await mkdir(destdir, { recursive: true }); const entries = await readdir(srcdir, { withfiletypes: true }); let count = 0; for (const entry of entries) { const srcpath = path.join(srcdir, entry.name); const destpath = path.join(destdir,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/skills-install.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

2import { Command } from "commander"; L3: import { spawn, spawnSync } from "node:child_process"; L4: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

Findings

2 Critical11 High5 Medium8 Low

CriticalCredential Exfiltrationsrc/cli/auth.ts

CriticalReverse Shelldist/cli/auth-commands.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/emdee.js

HighSame File Env Network Executiondist/cli/auth-commands.js

HighSandbox Evasion Gated Capabilitydist/cli/auth-commands.js

HighExternal Ai Agent Control Surface Mutationdist/cli/skills-install.js

HighRuntime Package Installbin/emdee.js

HighSemantic Analysis Limiteddist/mcp/server.js

HighKnown Malware Source Similaritybin/emdee.js

HighKnown Malware Source Similaritydist/cli/auth-commands.js

Affected versions and remediation

This report applies to @aisystemresources/emdee@0.24.9.

See all versions of @aisystemresources/emdee for other recorded verdicts.

Review the evidence and your use of @aisystemresources/emdee@0.24.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 09:54:27.309Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.