@eventmodelers/cli@2.0.26
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is undisclosed runtime telemetry enabled by default through scaffolding. It sends board and slice metadata beyond the cost tracking described by the consent prompt, so warn rather than block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the scaffold command, then a build agent processes a slice and reports usage.
Impact
The service receives project board and slice identifiers and descriptive metadata without a telemetry consent prompt during scaffolding.
Mechanism
Scaffolding sets agent tracing on without asking; the runner POSTs usage and slice metadata with the Eventmodelers token to the configured API.
AI rationale
This is undisclosed runtime telemetry enabled by default through scaffolding. It sends board and slice metadata beyond the cost tracking described by the consent prompt, so warn rather than block.
Evidence
lib/scaffold.jsshared/build-kit/ralph-claude.jsshared/build-kit/lib/tracing.jsshared/build-kit/lib/ralph.jscli.js.eventmodelers/config.json.eventmodelers/trace/slices.jsonl
Network endpoints1
api.eventmodelers.ai/api/org/${organizationId}/boards/${trace.boardId}/agent-traces
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Scaffolding runs `config --agent-tracing on` after an install that skips the tracing question, silently enabling runtime telemetry by default.
- When tracing is enabled, each build trace contains board and slice identifiers, slice title, context, ticket number, feature, agent identifiers, and usage data.
- The runner sends traces in a POST with the Eventmodelers token to the per-board agent-traces endpoint.
- The tracing prompt asks whether to track slice costs but does not disclose the additional board and slice metadata sent.
Evidence against
- The destination defaults to the package's own Eventmodelers API, and the token is sent to that configured service.
- Tracing is limited to build runs that produce slice usage; the inspected trace fields do not include prompts, source code, or other providers' credentials.
- The CLI provides a project setting to turn agent tracing off; ordinary initialization asks before enabling it.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
12 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
121stdio: ['inherit', traced ? 'pipe' : 'inherit', 'inherit'],
L122: shell: true,
L123: env: { ...childEnv, RALPH_PROMPT_FILE: promptFile, ...extraEnv },
High
stacks/supabase/templates/root/server.tsView file
Findings
1 Critical8 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighCredential Redirect Persistencecli.js
HighExternal Ai Agent Control Surface Mutationcli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationextensions/prototype/index.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.26.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.