registry / @eventmodelers/cli / 2.0.32
@eventmodelers/cli@2.0.32
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest exposes a CLI and has no lifecycle hooks. Reviewed credential handling prompts for Eventmodelers credentials and stores them locally, while prototype agent configuration is performed by explicit setup commands.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs CLI commands such as credential setup or prototype initialization.
Impact
Expected project setup and communication with the Eventmodelers service; no unauthorized credential transfer or agent-control change was identified.
Mechanism
The CLI prompts for Eventmodelers credentials, saves them locally, and uses the configured service URL. Prototype setup installs skills and updates the project CLAUDE.md.
AI rationale
The manifest exposes a CLI and has no lifecycle hooks. Reviewed credential handling prompts for Eventmodelers credentials and stores them locally, while prototype agent configuration is performed by explicit setup commands.
Evidence
~/.eventmodelers/boards/<boardId>.json<project>/.claude/skills/<project>/CLAUDE.md
Network endpoints2
app.eventmodelers.aiapi.eventmodelers.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is a CLI for Eventmodelers and declares no install, preinstall, or postinstall hook.
- Credential setup asks the user to paste values from the Eventmodelers account page.
- Board credentials are saved locally with restrictive file permissions.
- The prototype extension installs skills and edits CLAUDE.md as part of its explicit init command.
- The prototype API uses the configured service base URL, defaulting to api.eventmodelers.ai.
Evidence against
- The CLI has network, process execution, and file-writing capabilities, which are expected for a scaffolding and agent-running CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
121stdio: ['inherit', traced ? 'pipe' : 'inherit', 'inherit'],
L122: shell: true,
L123: env: { ...childEnv, RALPH_PROMPT_FILE: promptFile, ...extraEnv },
High
stacks/supabase/templates/root/server.tsView file
Findings
8 High5 Medium5 Low
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighCredential Redirect Persistencecli.js
HighExternal Ai Agent Control Surface Mutationcli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationextensions/prototype/index.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.32.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.