emblem-ai

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of several NPM packages belonging to the vendor, including @emblemvault/auth-sdk, @emblemvault/emblem-auth-react, @emblemvault/hustle-react, hustle-incognito, and reflexive. These are used for authentication and AI integration.
  • [COMMAND_EXECUTION]: The reflexive tool provides a command-line interface for application introspection. While it includes powerful capabilities such as file modification and shell execution (--write, --shell), the documentation emphasizes that these are disabled by default and require explicit activation by a trusted operator.
  • [DATA_EXFILTRATION]: The reflexive utility is designed to read application logs and files to provide context to AI agents for debugging. This capability is inherent to its purpose as an introspection tool and is restricted to local interfaces by default (--host localhost).
  • [REMOTE_CODE_EXECUTION]: The skill utilizes npx reflexive to launch its introspection dashboard and agent. This is a standard pattern for JavaScript developer tools and executes code from the vendor's own package repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 03:42 PM