registry / @expo/agent-cli / 1.0.4
@expo/agent-cli@1.0.4
Agent-native CLI on top of the Expo CLI family
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe flagged source supports ordinary CLI setup and project runtime behavior. The manifest has no install-time hook; the flagged prepublishOnly script builds the package, and the inspected runtime hints do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI or its setup commands.
Impact
No confirmed attack surface or unauthorized account, credential, or agent-control effect was established.
Mechanism
The package can add a managed project guidance block, map agent skill directories, and invoke Expo for the current project. The observed session and WebSocket code handles local logging and protocol setup.
AI rationale
The flagged source supports ordinary CLI setup and project runtime behavior. The manifest has no install-time hook; the flagged prepublishOnly script builds the package, and the inspected runtime hints do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and bundled main entrypoint; its only lifecycle script is prepublishOnly, which builds the package.
- The AGENTS.md helper maintains a marked block while preserving surrounding project content; it writes only when its setup option is enabled.
- The agent integration files list standard project and home skill directories for supported agents.
- The account-related byte hints fall within bundled session logging code that creates local session metadata and activates a local event sink.
- The flagged process launch runs Expo from the project root with the CLI's constructed arguments.
- The runtime-operation hint is in WebSocket protocol handling.
Evidence against
- No install-time consumer mutation or unrelated credential transfer was identified in the inspected source.
- The agent configuration behavior is part of setup functionality, with the AGENTS.md write gated by an option; the inspected integration targets are directory mappings.
- The runtime package-install hint reflects an Expo CLI launch for the project, not installation of another release of @expo/agent-cli.
Behavioral surface
Source & flagged code
6 flaggedbuild/cli/472.index.jsView file
257const command = `npx expo ${args.join(' ')}`;
L258: const built = await spawn('npx', ['expo', ...args], { cwd: projectRoot, timeoutMs });
L259: if (built.spawnError) {
High
Child Process
Package source references child process execution.
build/cli/472.index.jsView on unpkg · L257257const command = `npx expo ${args.join(' ')}`;
L258: const built = await spawn('npx', ['expo', ...args], { cwd: projectRoot, timeoutMs });
L259: if (built.spawnError) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build/cli/472.index.jsView on unpkg · L257build/cli/734.index.jsView file
5035L5036: module.exports = eval("require")("bufferutil");
L5037:
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabuild/cli/885.index.js
HighChild Processbuild/cli/472.index.js
HighExternal Ai Agent Control Surface Mutationbuild/cli/271.index.js
HighRuntime Package Installbuild/cli/472.index.js
HighSemantic Analysis Limitedbuild/cli/223.index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalbuild/cli/734.index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.4.
See all versions of @expo/agent-cli for other recorded verdicts.
- Review the evidence and your use of @expo/agent-cli@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.