registry / @eventmodelers/cli / 2.0.13
@eventmodelers/cli@2.0.13
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The flagged credential and agent-configuration paths resolve to configured service use and user-invoked integration behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI acts when a user invokes its setup or agent commands.
Impact
No confirmed unauthorized credential transfer, account action, or agent-control mutation was found.
Mechanism
The inspected credential, realtime, and agent-integration behavior serves the configured Eventmodelers platform and user-selected agent workflows.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior. The flagged credential and agent-configuration paths resolve to configured service use and user-invoked integration behavior.
Network endpoints1
api.eventmodelers.ai
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares only a test script and no install lifecycle hook; the inspected runtime dependencies contain build and test scripts, with no install hook.
- The platform credential flow prompts for credentials and saves them locally. The default MCP destination is api.eventmodelers.ai, and the MCP registration uses the configured platform URL.
- Realtime subscriptions and board-change callbacks run as part of the invoked agent; the callbacks observe changes, trigger work, or stop the matching agent.
- Agent integration writes copy selected skill files or synchronize project learnings to AGENTS.md; inspected setup and runtime code shows no unconsented broad agent-control mutation.
- The optional Mastra runner uses the configured model endpoint and MASTRA_API_KEY; it sends the Eventmodelers token to the configured Eventmodelers MCP URL.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
11 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
119stdio: ['inherit', traced ? 'pipe' : 'inherit', 'inherit'],
L120: shell: true,
L121: env: { ...childEnv, RALPH_PROMPT_FILE: promptFile, ...extraEnv },
High
stacks/supabase/templates/root/server.tsView file
Findings
1 Critical7 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighCredential Redirect Persistencecli.js
HighExternal Ai Agent Control Surface Mutationcli.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.13.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.