emblem-ai
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of several NPM packages belonging to the vendor, including
@emblemvault/auth-sdk,@emblemvault/emblem-auth-react,@emblemvault/hustle-react,hustle-incognito, andreflexive. These are used for authentication and AI integration. - [COMMAND_EXECUTION]: The
reflexivetool provides a command-line interface for application introspection. While it includes powerful capabilities such as file modification and shell execution (--write,--shell), the documentation emphasizes that these are disabled by default and require explicit activation by a trusted operator. - [DATA_EXFILTRATION]: The
reflexiveutility is designed to read application logs and files to provide context to AI agents for debugging. This capability is inherent to its purpose as an introspection tool and is restricted to local interfaces by default (--host localhost). - [REMOTE_CODE_EXECUTION]: The skill utilizes
npx reflexiveto launch its introspection dashboard and agent. This is a standard pattern for JavaScript developer tools and executes code from the vendor's own package repository.
Audit Metadata