@expo/agent-cli@1.0.0
Agent-native CLI on top of the Expo CLI family
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by static inspection, but its explicit command changes AI-agent instruction and capability surfaces in a project. This warrants a warning under the agent-control policy rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
A user runs expo-agent-cli agents:setup or a skill-sync command.
Impact
The command can influence configured coding agents within the selected project, but it has no install-time trigger.
Mechanism
Project AGENTS.md management and agent skill symlink synchronization.
AI rationale
The package is not malicious by static inspection, but its explicit command changes AI-agent instruction and capability surfaces in a project. This warrants a warning under the agent-control policy rather than a publish block.
Evidence
build/cli/159.index.jsbuild/cli/103.index.jsAGENTS.md.expo/agent-skill-links.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest has no install lifecycle hook; its only lifecycle script is prepublishOnly.
- The explicit agents:setup command can create or update a managed block in the project AGENTS.md.
- Explicit skill syncing can replace Expo-managed skill links in selected agent directories.
- The flagged ADB module resolves local SDK paths and environment variables.
Evidence against
- No install-time execution or runtime self-dependency is declared.
- AGENTS.md writes are limited to an explicit CLI command, preserve content outside managed markers, and reject symlinks.
- No credential harvesting or secret exfiltration was found in the inspected paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedProtestwareUrlStrings
Source & flagged code
3 flaggedbuild/cli/262.index.jsView file
4969L4970: module.exports = eval("require")("bufferutil");
L4971:
Low
Eval
Package source references a known benign dynamic code generation pattern.
build/cli/262.index.jsView on unpkg · L4969build/cli/159.index.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
const stats = await external_fs_default().promises.lstat(filepath).catch(() => null);
if (stats?.issymboliclink()) {
throw new errors.commanderror('agents_md_symlink', `${agents_md_file} is a symlink, so writing the managed block would edit the file it points at rather than a file in this project. replace it with a regular file, or delete it, then run the command again.`);
}
const contents = await external_fs_default().promises.readfile(filepath, 'utf8').catch(() => null);
const next = applymanagedblock(contents, blockbody);
if (next === contents) {
return { path: agents_md_file, action: 'skipped' };
}
await external_fs_default().promises.writefile(filepath
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
build/cli/159.index.jsFindings
2 High4 Medium6 Low
HighExternal Ai Agent Control Surface Mutationbuild/cli/159.index.js
HighSemantic Analysis Limitedbuild/cli/148.index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalbuild/cli/262.index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.0.
See all versions of @expo/agent-cli for other recorded verdicts.
- Review the evidence and your use of @expo/agent-cli@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.