registry / @proagentstore/cli / 0.4.154
@proagentstore/cli@0.4.154
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and source inspection tied the flagged behavior to normal CLI operations. The update check is activated by `pags up`; login and the site-builder bridge use PAGS endpoints.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI, such as `pags up`, or starts a coding session through the runner.
Impact
No unauthorized credential transfer or other concrete attack impact was established.
Mechanism
The CLI checks for updates during `up`, sends login validation to the PAGS API, and launches the configured coding engine for its work directory.
AI rationale
The manifest has no install lifecycle hook, and source inspection tied the flagged behavior to normal CLI operations. The update check is activated by `pags up`; login and the site-builder bridge use PAGS endpoints.
Network endpoints1
api.proagentstore.online
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the CLI to its bootstrap and defines build, development, and typecheck scripts; it has no install lifecycle hook.
- The bootstrap checks for updates only when the `up` command runs, then installs the selected CLI release in its cache.
- Login validates the saved session token with the PAGS API at `api.proagentstore.online`.
- Coding sessions launch the configured engine with its selected working directory and arguments; repository checks run Git inspection commands in that directory.
- The site-builder bridge pins its broker credential to the PAGS API’s run-specific broker route.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/index.jsView file
1444if (restarter === "command") {
L1445: deps.spawn(process.env[RESTART_COMMAND_ENV], { shell: true, detached: true, stdio: "ignore", env: process.env }).unref();
L1446: deps.exit(0);
High
383// src/commands/login.ts
L384: import { spawn } from "child_process";
L385: import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
L386: import { createServer } from "http";
L387: import { homedir, hostname } from "os";
...
L391: // src/commands/login-device.ts
L392: function chooseLoginFlow(opts, env = process.env, platform = process.platform) {
L393: if (opts.device) return { flow: "device", why: "--device" };
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/headless.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.154.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.154 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.