registry / @proagentstore/cli / 0.4.161
@proagentstore/cli@0.4.161
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install hook, and inspected execution paths match explicit CLI and runner functions. The scanner’s process and network signals did not establish an attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Normal CLI use, including invoking `pags up` or a runner task.
Impact
No harmful effect on the user or their files was established.
Mechanism
The inspected code handles launcher restarts, checks an engine version, runs a fixed Git status query, and restricts site-builder calls to an allowlist.
AI rationale
The manifest has no install hook, and inspected execution paths match explicit CLI and runner functions. The scanner’s process and network signals did not establish an attack.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build, dev, and typecheck scripts; it has no install lifecycle hook.
- The launcher chooses restart behavior from its runtime mode and exits for a supervised service restart.
- Engine checks run the resolved executable with its version arguments and a five-second timeout.
- Repository checks run fixed Git arguments in the requested work directory.
- The site builder restricts calls to its allowed tool list and says deployment requires owner approval.
- The launcher checks for updates only when the selected command is `up`, unless updates are disabled.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/index.jsView file
1540if (restarter === "command") {
L1541: deps.spawn(process.env[RESTART_COMMAND_ENV], { shell: true, detached: true, stdio: "ignore", env: process.env }).unref();
L1542: deps.exit(0);
High
388// src/commands/login.ts
L389: import { spawn } from "child_process";
L390: import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
L391: import { createServer } from "http";
L392: import { homedir, hostname } from "os";
...
L396: // src/commands/login-device.ts
L397: function chooseLoginFlow(opts, env = process.env, platform = process.platform) {
L398: if (opts.device) return { flow: "device", why: "--device" };
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/engine-check.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.161.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.161 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.