registry / @eventmodelers/cli / 2.0.36
@eventmodelers/cli@2.0.36
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a CLI with no install lifecycle hooks. The reviewed credential flow targets the configured Eventmodelers API, and agent configuration is performed through user-invoked CLI commands.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when a user invokes it; MCP registration is performed through init-mcp.
Impact
No malicious or unauthorized effect was identified in the reviewed paths.
Mechanism
The CLI stores user-provided platform credentials and uses them with the configured Eventmodelers API. It passes the platform token to the agent runner for its platform integration.
AI rationale
The package is a CLI with no install lifecycle hooks. The reviewed credential flow targets the configured Eventmodelers API, and agent configuration is performed through user-invoked CLI commands.
Evidence
package.jsoncli.jslib/fetch.js
Network endpoints1
api.eventmodelers.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares a CLI executable and no install lifecycle hooks.
- The CLI defaults Eventmodelers API requests to https://api.eventmodelers.ai; the fetch client sends its configured token in the x-token header.
- The CLI passes its configured Eventmodelers token to the agent runner for the package’s platform integration.
- MCP configuration is exposed through the explicit init-mcp command.
Evidence against
- The source includes shell execution, network access, credential storage, and agent configuration writes, but these support the CLI’s documented agent and platform features.
- The Franconia URL appears as an example of a user-supplied Mastra endpoint, not as a fixed credential destination.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
11 flaggedstacks/supabase/templates/root/src/common/testHelpers.tsView file
1import {execSync} from 'child_process';
L2: import {readFileSync, writeFileSync, unlinkSync} from 'fs';
High
Child Process
Package source references child process execution.
stacks/supabase/templates/root/src/common/testHelpers.tsView on unpkg · L1shared/build-kit/ralph-exec.jsView file
121stdio: ['inherit', traced ? 'pipe' : 'inherit', 'inherit'],
L122: shell: true,
L123: env: { ...childEnv, RALPH_PROMPT_FILE: promptFile, ...extraEnv },
High
stacks/supabase/templates/root/server.tsView file
Findings
8 High5 Medium5 Low
HighChild Processstacks/supabase/templates/root/src/common/testHelpers.ts
HighShellshared/build-kit/ralph-exec.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighCredential Redirect Persistencecli.js
HighExternal Ai Agent Control Surface Mutationcli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationextensions/prototype/index.js
HighRuntime Package Installstacks/supabase/templates/build-kit/lib/checks/90-tsc-build.cjs
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
MediumDynamic Requirestacks/supabase/templates/root/server.ts
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @eventmodelers/cli@2.0.36.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@2.0.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.