@pmate/cli@0.45.4
CLI utilities for the pMate project
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe inspected sources do not confirm the scanner's credential-exfiltration claim: the GitHub token flow is for GitHub CLI operations, and the shell PATH resolver explicitly avoids importing shell credentials. However, the Electron agent runtime exposes unrestricted local command execution to authenticated callers, which is a meaningful capability risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An authenticated Electron app invokes the runtime's `local.exec` method through the trusted IPC handler.
Impact
An agent or app caller with access to this method can run arbitrary local programs under the user's account.
Mechanism
The runtime forwards caller-provided command, arguments, cwd and environment to `execFile`; executable selection is not allowlisted.
AI rationale
The inspected sources do not confirm the scanner's credential-exfiltration claim: the GitHub token flow is for GitHub CLI operations, and the shell PATH resolver explicitly avoids importing shell credentials. However, the Electron agent runtime exposes unrestricted local command execution to authenticated callers, which is a meaningful capability risk.
Evidence
dist/templates/electron/agent-runtime.cjsdist/templates/electron/local-exec.cjsdist/templates/electron/shell-path.cjs
Network endpoints1
issue-api.pmate.chat
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Electron runtime exposes a logged-in `local.exec` method that accepts caller-supplied commands, arguments, working directories and environment variables.
- The local executor runs the supplied command with `shell:false`, but does not restrict which executable may be launched.
- The Electron IPC handler checks that the sender is trusted before forwarding calls to the runtime.
Evidence against
- The local execution capability is limited to an Electron template runtime and requires an identity to be configured.
- The shell PATH resolver says it reads only PATH and does not import shell credentials or execute caller arguments through the shell.
- The GitHub credential path obtains a token for a configured GitHub user and passes it to GitHub CLI operations; no foreign credential destination was identified in the inspected excerpt.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
10 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L183: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L184: const parsed = JSON.parse(raw);
L185: const store = normalizeStore(parsed);
...
L5821: flush(true);
L5822: output.end();
L5823: } catch (error) {
...
L7697: static async toWire(msg, transport) {
L7698: if (transport === "websocket") {
L7699: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L183: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L184: const parsed = JSON.parse(raw);
L185: const store = normalizeStore(parsed);
...
L5821: flush(true);
L5822: output.end();
L5823: } catch (error) {
...
L7697: static async toWire(msg, transport) {
L7698: if (transport === "websocket") {
L7699: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
3 Critical7 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/templates/electron/agent-runtime.cjs
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @pmate/cli@0.45.4.
See all versions of @pmate/cli for other recorded verdicts.
- Review the evidence and your use of @pmate/cli@0.45.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.