registry / @expo/agent-cli / 1.0.9
@expo/agent-cli@1.0.9
Agent-native CLI on top of the Expo CLI family
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe flagged account and runtime locations resolve to ordinary logging, caller-configured WebSocket headers, and project builds. The first-party CLI also performs later agent-skill linking based on a saved agent selection, so a warning for agent extension lifecycle risk is appropriate.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs expo start or expo install after previously selecting agents; skill syncing can be disabled with --no-agent-skills.
Impact
Skills supplied by project dependencies become available to selected agents and may affect their behavior in later sessions.
Mechanism
The CLI discovers project skills and creates links in the skill directories of agents whose selection was saved earlier.
AI rationale
The flagged account and runtime locations resolve to ordinary logging, caller-configured WebSocket headers, and project builds. The first-party CLI also performs later agent-skill linking based on a saved agent selection, so a warning for agent extension lifecycle risk is appropriate.
Evidence
build/cli/193.index.jsbuild/cli/271.index.jsbuild/cli/461.index.jsbuild/cli/726.index.jsbuild/cli/743.index.js.claude/skills.agents/skills
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json points to the CLI entrypoints and defines a prepublishOnly build command.
- The flagged account-action ranges in build/cli/index.js rotate local session log files; the other flagged range activates session logging. The WebSocket code copies caller-provided protocol and origin values into headers.
- The agent integration locations describe an AGENTS.md report, Expo-managed block markers, configured agent directories, and supported skill directories.
- Agent skill syncing is enabled unless disabled, but automatic syncing uses previously persisted agent selections. Explicit --agent selection persists that preference; expo start and expo install flows can invoke later syncing.
- Syncing discovers project skills and creates links in the selected agent skill directories. This exposes project dependency skills to those agents during later sessions.
- The project build helper runs npx expo with the project as its working directory.
Evidence against
- The inspected source shows user-invoked CLI flows and a saved agent selection gating automatic skill syncing; --no-agent-skills disables it.
- The inspected account-action locations resolve to local logging, rotation, and caller-configured WebSocket headers, with no account action or credential transfer identified.
Source & flagged code
6 flaggedbuild/cli/472.index.jsView file
257const command = `npx expo ${args.join(' ')}`;
L258: const built = await spawn('npx', ['expo', ...args], { cwd: projectRoot, timeoutMs });
L259: if (built.spawnError) {
High
Child Process
Package source references child process execution.
build/cli/472.index.jsView on unpkg · L257257const command = `npx expo ${args.join(' ')}`;
L258: const built = await spawn('npx', ['expo', ...args], { cwd: projectRoot, timeoutMs });
L259: if (built.spawnError) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
build/cli/472.index.jsView on unpkg · L257build/cli/734.index.jsView file
5035L5036: module.exports = eval("require")("bufferutil");
L5037:
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabuild/cli/248.index.js
HighChild Processbuild/cli/472.index.js
HighExternal Ai Agent Control Surface Mutationbuild/cli/248.index.js
HighRuntime Package Installbuild/cli/472.index.js
HighSemantic Analysis Limitedbuild/cli/193.index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalbuild/cli/734.index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.9.
See all versions of @expo/agent-cli for other recorded verdicts.
- Review the evidence and your use of @expo/agent-cli@1.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.