registry / @eventmodelers/cli / 2.0.12
@eventmodelers/cli@2.0.12
⚠ Under reviewEventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install hook, and the reviewed agent configuration writes are tied to an explicit CLI command. The PocketBase runtime dependency remains unresolved, so the source review cannot establish a clean verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Runtime use with the PocketBase realtime provider configured.
Impact
The unresolved runtime dependency prevents a complete safety determination for this path.
Mechanism
The package selects its PocketBase adapter, which imports the `pocketbase` dependency; that dependency's implementation was not resolved here.
AI rationale
The manifest has no install hook, and the reviewed agent configuration writes are tied to an explicit CLI command. The PocketBase runtime dependency remains unresolved, so the source review cannot establish a clean verdict.
Evidence
package.jsonshared/build-kit/lib/adapters/realtime-adapter.jsshared/build-kit/lib/adapters/pocketbase-realtime-adapter.js
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a CLI and declares only a test script, with no install lifecycle hook.
- The realtime adapter imports a PocketBase adapter and selects it when the configured provider is PocketBase; the manifest declares the `pocketbase` dependency.
- The bounded source snapshot does not include the PocketBase dependency implementation, so that runtime path remains unresolved.
- Agent-host files are written by the explicit `init-agents` command from skills already installed in the project.
Evidence against
- The inspected realtime subscription code retries failed subscriptions and invokes its supplied handler after joining; it does not establish an attack.
- The inspected agent setup writes host stubs or copies skills in response to an explicit CLI command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
10 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
119stdio: ['inherit', traced ? 'pipe' : 'inherit', 'inherit'],
L120: shell: true,
L121: env: { ...childEnv, RALPH_PROMPT_FILE: promptFile, ...extraEnv },
High
stacks/supabase/templates/root/server.tsView file
Findings
1 Critical6 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltashared/build-kit/lib/ralph.js
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.12.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.