@expo/agent-cli@1.0.2
Agent-native CLI on top of the Expo CLI family
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has dangerous user-invoked AI-agent configuration capabilities, but no automatic install hook or concrete malicious behavior was found. Downgrade to a warning for review of its broad dependency-skill linking and agent-control-surface writes.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs agents:setup or a smoke workflow that needs Expo Go.
Impact
An invoked setup can change agent-visible project instructions and expose linked dependency skills to selected coding agents.
Mechanism
User-invoked agent configuration, skill linking, and simulator tooling.
AI rationale
The package has dangerous user-invoked AI-agent configuration capabilities, but no automatic install hook or concrete malicious behavior was found. Downgrade to a warning for review of its broad dependency-skill linking and agent-control-surface writes.
Evidence
build/cli/271.index.jsbuild/cli/95.index.jsbuild/cli/824.index.jsAGENTS.md.expo/agent-skill-links.json.agents/skills.claude/skills.gitignore
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit agents:setup command creates or updates AGENTS.md and links installed-package skills.
- The setup code writes project-derived instructions that advertise a runtime JavaScript evaluation command.
- Skill synchronization scans dependency packages and creates links in agent skill directories.
- The smoke workflow invokes npx expo-go to download and install Expo Go on a selected simulator.
Evidence against
- package.json has only a prepublishOnly hook; installation does not automatically execute package code.
- Agent-control-surface changes require an explicit CLI command, not a lifecycle hook.
- AGENTS.md writes reject symlinks, and skill discovery rejects entries resolving outside their package root.
- No source evidence showed credential harvesting, secret exfiltration, hidden persistence, or an unrelated network endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggedbuild/cli/95.index.jsView file
357var programName = __webpack_require__(7969);
L358: // EXTERNAL MODULE: external "child_process"
L359: var external_child_process_ = __webpack_require__(5317);
High
Child Process
Package source references child process execution.
build/cli/95.index.jsView on unpkg · L357build/cli/734.index.jsView file
5035L5036: module.exports = eval("require")("bufferutil");
L5037:
Low
Eval
Package source references a known benign dynamic code generation pattern.
build/cli/734.index.jsView on unpkg · L5035build/cli/271.index.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
const stats = await external_fs_default().promises.lstat(filepath).catch(() => null);
if (stats?.issymboliclink()) {
throw new errors.commanderror('agents_md_symlink', `${agents_md_file} is a symlink, so writing the managed block would edit the file it points at rather than a file in this project. replace it with a regular file, or delete it, then run the command again.`);
}
const contents = await external_fs_default().promises.readfile(filepath, 'utf8').catch(() => null);
const next = applymanagedblock(contents, blockbody);
if (next === contents) {
return { path: agents_md_file, action: 'skipped' };
}
await external_fs_default().promises.writefile(filepath
Findings
4 High4 Medium6 Low
HighChild Processbuild/cli/95.index.js
HighExternal Ai Agent Control Surface Mutationbuild/cli/271.index.js
HighRuntime Package Installbuild/cli/824.index.js
HighSemantic Analysis Limitedbuild/cli/223.index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalbuild/cli/734.index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.2.
See all versions of @expo/agent-cli for other recorded verdicts.
- Review the evidence and your use of @expo/agent-cli@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.