@eventmodelers/cli@1.0.59
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, Cratis, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe Claude bridge runner discloses the saved board token to the configured Claude process without a separate credential-forwarding guard. The conditional, user-selected runtime path warrants a warning, not a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user starts the bridge with the Claude runner, including by selecting --claude.
Impact
The board credential is disclosed to the Claude process and may be forwarded to its configured backend; the inspected source does not establish that backend’s destination.
Mechanism
The runner loads saved configuration, prepends the board token to the prompt, and passes it to Claude with permissions bypassed. A configured Anthropic base URL can change the backend.
AI rationale
The Claude bridge runner discloses the saved board token to the configured Claude process without a separate credential-forwarding guard. The conditional, user-selected runtime path warrants a warning, not a publish block.
Evidence
stacks/bridge/templates/bridge/ralph-claude.jsshared/build-kit/lib/ralph.jscli.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Agent-host integrations use declared directories and the separate init-agents command writes to hosts selected by the user.
- The manifest exposes a CLI executable and contains no npm lifecycle script.
- The Claude bridge runner adds the saved board token to the prompt passed to Claude and starts it with permissions bypassed.
- The bridge selects Claude when requested with --claude or when no static adapter is available; a static adapter otherwise takes precedence.
- The runner loads saved configuration, and the board API uses the configured Eventmodelers service address, defaulting to api.eventmodelers.ai.
Evidence against
- The package has no install lifecycle hook; the credential exposure requires the bridge’s Claude runner to be selected.
- The inspected agent-host setup is a separate user-invoked command that writes to selected host directories.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggedstacks/bridge/templates/bridge/ralph-claude.jsView file
8import { startRalph, loadLocalConfig } from './lib/ralph.js';
L9: import { spawn } from 'child_process';
L10: import { dirname, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-claude.jsView on unpkg · L8stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
1 Critical6 High5 Medium3 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/bridge/templates/bridge/ralph-claude.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.59.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.