registry / @eventmodelers/cli / 1.0.104
@eventmodelers/cli@1.0.104
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 17d ago · by lpm-firewall-aiStatic inspection confirms an optional, user-started listener with cross-origin access and request-derived filesystem paths that lack containment checks. This is a concrete runtime risk, but the evidence does not establish malicious package intent or an installation-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user starts the listener with the `listen` command, after which a network or cross-origin request reaches its generate endpoint.
Impact
A requester able to reach the listener may overwrite files at paths formed from the supplied values, potentially damaging project data.
Mechanism
The listener binds a port without a host restriction, permits cross-origin requests, and joins request-provided context and slice-title values into filesystem paths before writing files.
AI rationale
Static inspection confirms an optional, user-started listener with cross-origin access and request-derived filesystem paths that lack containment checks. This is a concrete runtime risk, but the evidence does not establish malicious package intent or an installation-time attack.
Evidence
cli.jsshared/build-kit/code-export.mjs.slices/
Network endpoints1
localhost:3001
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI entrypoint and defines no install, preinstall, or postinstall hook.
- The listener starts only when a user invokes the `listen` command; it receives board data and writes it into the project’s slice directory.
- The listener accepts cross-origin requests and binds a port without specifying a host, leaving it reachable beyond the local machine on common Node configurations.
- The generate route uses request-provided context and slice titles in filesystem paths without containment checks, then writes files under the slice directory.
- The agent integration writes selected skill files to project configuration locations; the MCP registration uses project configuration and token environment references.
Evidence against
- No package installation hook was found, and the agent setup behavior is tied to CLI commands rather than package installation.
- The shell and process execution findings inspected are associated with a configured bridge hook, a project TypeScript check, or an explicit Spec Kitty adapter operation.
Behavioral surface
Source & flagged code
9 flaggedstacks/bridge/templates/bridge/ralph-local-ai.jsView file
12import { startRalph } from './lib/ralph.js';
L13: import { spawn } from 'child_process';
L14: import { dirname, join, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-local-ai.jsView on unpkg · L12stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/bridge/templates/bridge/ralph-local-ai.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.104.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.104 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.