registry / @eventmodelers/cli / 1.0.73
@eventmodelers/cli@1.0.73
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, Cratis, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no lifecycle scripts and no concrete attack behavior in the required flagged paths. Agent configuration requires an explicit CLI command and host selection; the other flagged process and network operations are tied to user-configured product workflows.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running the CLI's explicit init-agents command, a bridge template, a build check, or the Spec Kitty adapter.
Impact
These inspected behaviors support ordinary product functions and do not establish unconsented agent control, credential exfiltration, or another attack.
Mechanism
The CLI writes selected host skill files; bridge templates invoke Claude or a configured hook; the check runs TypeScript; the adapter fetches board data using configured credentials.
AI rationale
Source inspection found no lifecycle scripts and no concrete attack behavior in the required flagged paths. Agent configuration requires an explicit CLI command and host selection; the other flagged process and network operations are tied to user-configured product workflows.
Network endpoints1
api.eventmodelers.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entrypoint and dependencies, with no lifecycle scripts declared.
- The agent host map in cli.js defines file destinations; init-agents asks which hosts to configure, then writes skill pointers or copies skills.
- The realtime adapter connects using configured Supabase values, sets the supplied token, and dispatches broadcast payloads to supplied handlers.
- The bridge Claude and shell runners are template programs; the shell runner requires an explicitly configured hook command.
- The flagged build check invokes the project's TypeScript check, while the Spec Kitty adapter sends configured board credentials to its configured Eventmodelers API base URL.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedstacks/bridge/templates/bridge/ralph-claude.jsView file
8import { startRalph, loadLocalConfig } from './lib/ralph.js';
L9: import { spawn } from 'child_process';
L10: import { dirname, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-claude.jsView on unpkg · L8stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
1 Critical6 High5 Medium3 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/bridge/templates/bridge/ralph-claude.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.73.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.