@proagentstore/cli@0.4.102
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe package has no install hook or covert attack chain, so the source does not support blocking it as malware. Its authenticated coding workflow nevertheless launches local agents with broad default permissions, warranting a warning for dangerous capability.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `pags up`, then an authorized coding-start request reaches the local runner.
Impact
The connected workflow can exercise broad local command and file access, increasing potential damage if its account or task source is compromised.
Mechanism
The runner starts a configured coding agent in a local working directory; several default agent commands disable approval checks or enable full access.
AI rationale
The package has no install hook or covert attack chain, so the source does not support blocking it as malware. Its authenticated coding workflow nevertheless launches local agents with broad default permissions, warranting a warning for dangerous capability.
Evidence
package.jsondist/index.jsdist/browser-runner/server.jsdist/browser-runner/coding/runtime.jsdist/browser-runner/coding/handlers.jsdist/browser-runner/coding/headless.js
Network endpoints1
api.proagentstore.online
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and has no install lifecycle scripts.
- The user-invoked `up` command starts the runner and connects it to the ProAgentStore service.
- The runner requires authorization for requests, and its coding-start route passes requests to the coding runtime.
- The coding runtime starts a local session in a configured working directory using request-supplied settings.
- Default Claude, Gemini, and Codex commands bypass permission checks or use full-access mode; the runner spawns the selected command locally.
Evidence against
- No automatic install-time execution or unguarded coding-start route was found.
- The coding capability requires a user to start the runner and an authorized request to reach its local server.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
7 flaggeddist/browser-runner/local-artifact/runtime.jsView file
22*/
L23: import { spawn as nodeSpawn } from "node:child_process";
L24: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/local-artifact/runtime.jsView on unpkg · L22dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @proagentstore/cli@0.4.50
matchedIdentity = npm:QHByb2FnZW50c3RvcmUvY2xp:0.4.50
similarity = 0.462
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1286if (restarter === "command") {
L1287: deps.spawn(process.env[RESTART_COMMAND_ENV], { shell: true, detached: true, stdio: "ignore", env: process.env }).unref();
L1288: deps.exit(0);
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/browser-runner/local-artifact/runtime.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.102.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.102 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.