registry / @proagentstore/cli / 0.4.160
@proagentstore/cli@0.4.160
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and inspected network and process behavior is associated with user-run CLI and runner functions. The scanner's shell, process, environment, and network signals correspond to these product operations; the inspected source did not establish an attack surface.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI or starts a configured browser-runner task.
Impact
No concrete unauthorized credential transfer, destructive action, or unconsented installation-time mutation was established.
Mechanism
The launcher can check for and install a newer package release during `up`; runner functions communicate with the service and launch configured tools in the configured work directory.
AI rationale
The manifest has no install lifecycle hook, and inspected network and process behavior is associated with user-run CLI and runner functions. The scanner's shell, process, environment, and network signals correspond to these product operations; the inspected source did not establish an attack surface.
Evidence
package.jsondist/bootstrap.jsdist/index.jsdist/browser-runner/site-builder/runtime.jsdist/browser-runner/coding/repo.jsdist/browser-runner/coding/headless.js
Network endpoints2
api.proagentstore.online127.0.0.1:49171
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI and payload entrypoint; its listed scripts are build, dev, and typecheck, with no install lifecycle hook.
- The launcher checks for updates only when the user runs `up`, and skips the check for source runs or when the opt-out is set.
- The API base defaults to the ProAgentStore service; runner traffic defaults to localhost.
- The site-builder broker route is on the ProAgentStore API host.
- Repository cloning uses git with the supplied clone URL and disables interactive prompts.
- The headless runner starts the configured engine in its configured work directory with the engine environment.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/index.jsView file
1540if (restarter === "command") {
L1541: deps.spawn(process.env[RESTART_COMMAND_ENV], { shell: true, detached: true, stdio: "ignore", env: process.env }).unref();
L1542: deps.exit(0);
High
388// src/commands/login.ts
L389: import { spawn } from "child_process";
L390: import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
L391: import { createServer } from "http";
L392: import { homedir, hostname } from "os";
...
L396: // src/commands/login-device.ts
L397: function chooseLoginFlow(opts, env = process.env, platform = process.platform) {
L398: if (opts.device) return { flow: "device", why: "--device" };
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/headless.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.160.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.160 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.