registry / @aisystemresources/emdee / 0.25.1

@aisystemresources/emdee@0.25.1

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The postinstall hook automatically installs package-owned skills into the user’s Claude skills directory, which warrants a warning for agent extension lifecycle risk. The inspected authentication flow does not substantiate the scanner’s credential exfiltration finding.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with its postinstall hook enabled and the bundled installer present.

Impact

Package-provided skills become available to Claude after installation.

Mechanism

The hook runs the bundled installer, which copies Markdown skill files from the package into ~/.claude/skills.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/cli/skills-install.js~/.claude/skills/

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.mjs during installation.
The postinstall invokes the bundled skills installer unless EMDEE_SKIP_POSTINSTALL=1 or the bundle is absent.
The installer copies package skill Markdown files into the user’s ~/.claude/skills directory.
The login flow obtains a token from its configured host and stores that host with the token; whoami sends it to that same host.

Evidence against

The inspected authentication flow does not send an existing unrelated session token to a separate recipient.
The scanner’s credential warning is not supported by the inspected token exchange and whoami paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

14 flagged

package.jsonView file

Lines 11-51json

11 "emdee": "bin/emdee.js"

12 },

13 "publishConfig": {

14 "access": "public"

15 },

16 "scripts": {

17 "dev": "next dev --webpack",

18 "build": "next build --webpack",

19 "start": "next start",

20 "lint": "eslint",

21 "mcp": "tsx src/mcp/server.ts",

22 "typecheck": "tsc --noEmit",

23 "test:context": "node --import tsx --test scripts/test-context-startup.ts scripts/test-context-tools.ts",

24 "e2e": "playwright test",

25 "e2e:ui": "playwright test --ui",

26 "e2e:report": "playwright show-report",

27 "check:migrations": "node scripts/check-migration-drift.mjs",

28 "ci-package": "node scripts/verify-package.mjs",

29 "build:cli": "node scripts/build-cli.mjs",

30 "prepublishOnly": "node scripts/build-cli.mjs",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test:access": "node --import tsx --test scripts/test-agent-access.ts scripts/test-oauth-consent.ts scripts/test-oauth-resource.ts scripts/test-admin-access.ts scripts/test-admin-metrics.ts scripts/test-publication-scope.ts scripts/test-publication-rename.ts scripts/test-pdf-export.ts",

33 "test:auth": "node --import tsx --test scripts/test-native-auth.ts scripts/test-native-auth-proxy.ts scripts/test-native-auth-routes.ts scripts/test-google-auth-flow.ts scripts/test-native-auth-database.ts scripts/test-workspace-connection.ts scripts/test-image-upload-route.ts",

34 "test:knowledge": "node --import tsx --test scripts/test-knowledge.ts",

35 "test:storage": "node --import tsx --test scripts/test-storage-integrity.ts",

36 "benchmark:context": "node --import tsx scripts/benchmark-context.ts",

37 "test:discovery": "node --import tsx --test scripts/test-discovery.ts",

38 "test:discovery:database": "node --import tsx --test scripts/test-discovery-database.ts",

39 "verify:discovery:ui": "node scripts/discovery-ui-fixture.mjs",

40 "test:plugin": "node --import tsx --test scripts/test-public-plugin.ts",

41 "build:plugin": "node scripts/build-public-plugin.mjs",

42 "test:connectors": "node scripts/test-connector-setup.mjs",

43 "test:sidebar": "node scripts/test-sidebar-navigation.mjs",

44 "test:lint-config": "node --test tooling/eslint-config-next-literal-roots/test/*.test.mjs"

45 },

46 "files": [

47 "bin/",

48 "dist/",

49 "scripts/postinstall.mjs",

50 "src/cli/",

51 "src/core/",

bin/emdee.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import { spawn, spawnSync } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

dist/mcp/server.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg

18function adminClient() { L19: const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY; L20: return createClient( ... L1114: const admin = adminClient(); L1115: const { data: direct } = await admin.from("doc_shares").select("id, share_root").eq("grantee_id", granteeId).eq("owner_id", ownerId).eq("path_prefix", relPath).eq("permission", "wr... L1116: if (direct && isWithinShareRootBoundary(relPath, direct.share_root)) return true; ... L1905: { "name": "get_image", "description": "Fetch an image from the vault and return it as a visual content block so you can see and analyze it. Use this to label images (patch_preamble... L1906: { "name": "upload_image", "description": "Upload an image (jpg/png/gif/webp/svg) as base64 to the vault. Creates a markdown doc tha

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp/server.jsView on unpkg · L18

dist/cli/auth-commands.jsView file

Lines 1-26javascript

1// src/cli/auth-commands.ts

2import { parseArgs } from "node:util";

4// src/cli/auth.ts

5import { createHash, randomBytes } from "node:crypto";

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises";

src/cli/auth.tsView file

Lines 1-32typescript

1// SPRINT-091: CLI auth — PKCE loopback OAuth against emdee.tech.

2//

3// Follows RFC 8252 (OAuth 2.0 for native apps) + dynamic client registration

4// via /oauth/register (matches Codex + Claude Code patterns already in use).

5// Credentials land in ~/.config/emdee/credentials.json at 0600.

6//

7// Token has a 30-day TTL and there is no refresh grant on the server today,

8// so credentials are simple: access_token + client_id + host + saved_at. When

9// a token expires, the CLI surfaces `run 'emdee login'` — same UX as Codex.

dist/cli/skills-install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { readdir, mkdir, copyfile, stat } from "node:fs/promises"; import { parseargs } from "node:util"; import path from "node:path"; import os from "node:os"; import { fileurltopath } from "node:url"; var default_target = path.join(os.homedir(), ".claude", "skills"); var pkg_root = path.resolve(path.dirname(fileurltopath(import.meta.url)), "..", ".."); var skills_src = path.join(pkg_root, "skills"); async function copydirrecursive(srcdir, destdir) { await mkdir(destdir, { recursive: true }); const entries = await readdir(srcdir, { withfiletypes: true }); let count = 0; for (const entry of entries) { const srcpath = path.join(srcdir, entry.name); const destpath = path.join(destdir,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/skills-install.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

2import { Command } from "commander"; L3: import { spawn, spawnSync } from "node:child_process"; L4: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

Findings

2 Critical10 High5 Medium8 Low

CriticalCredential Exfiltrationsrc/cli/auth.ts

CriticalReverse Shelldist/cli/auth-commands.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/emdee.js

HighSame File Env Network Executiondist/cli/auth-commands.js

HighSandbox Evasion Gated Capabilitydist/cli/auth-commands.js

HighExternal Ai Agent Control Surface Mutationdist/cli/skills-install.js

HighRuntime Package Installbin/emdee.js

HighSemantic Analysis Limiteddist/mcp/server.js

HighKnown Malware Source Similaritybin/emdee.js

HighKnown Malware Source Similaritydist/cli/auth-commands.js

Affected versions and remediation

This report applies to @aisystemresources/emdee@0.25.1.

See all versions of @aisystemresources/emdee for other recorded verdicts.

Review the evidence and your use of @aisystemresources/emdee@0.25.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 05:59:00.909Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.