registry / @proagentstore/cli / 0.4.167
@proagentstore/cli@0.4.167
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The scanner’s execution and network signals correspond to user-invoked CLI and runner operations, while the manifest has no install hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Runtime features activate through CLI commands or runner requests; no install lifecycle hook was found.
Impact
No unintended credential disclosure, install-time mutation, or unrelated account action was established.
Mechanism
The reviewed process calls launch configured coding or runner commands, and the inspected login and broker code use PAGS service endpoints.
AI rationale
Source inspection found no concrete attack behavior. The scanner’s execution and network signals correspond to user-invoked CLI and runner operations, while the manifest has no install hook.
Network endpoints1
api.proagentstore.online
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and declares only build, development, and typecheck scripts; it has no install lifecycle hook. Its inspected dependencies are Commander and Chalk.
- Login validates the saved session token against the package’s PAGS API and stores the resulting session for CLI use.
- The launcher checks for an update only when the `up` command is invoked.
- Inspected process execution launches a configured coding engine; repository cloning targets a specified work directory, and terminal capture targets a selected local session.
- The GitHub runner setup function validates its request and target before starting a runner job.
- The broker URL is restricted to the PAGS site-builder endpoint; the reviewed source showed no unintended credential transfer or install-time mutation.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/actions-runner.jsView file
138if (asset.zip)
L139: await step(job, deps, "powershell", ["-NoProfile", "-Command", `Expand-Archive -Force -Path '${archive}' -DestinationPath '${job.dir}'`], req.token);
L140: else
High
Shell
Package source references shell execution.
dist/browser-runner/coding/actions-runner.jsView on unpkg · L13822*/
L23: import { execFile, spawnSync } from "node:child_process";
L24: import { randomUUID } from "node:crypto";
...
L47: const file = `actions-runner-${os}-${cpu}-${version}.${zip ? "zip" : "tar.gz"}`;
L48: return { file, url: `https://github.[redacted]${version}/${file}`, zip };
L49: }
...
L211: // `.runner` is written by config with a UTF-8 BOM on some platforms.
L212: const r = JSON.parse(raw.replace(/^/, ""));
L213: return { dir, managed, name: typeof r.agentName === "string" ? r.agentName : null, url: typeof r.gitHubUrl === "string" ? r.gitHubUrl : null };
...
L220: export function liveRunnerDeps() {
L221: const win = process.platform === "win32";
L222: return {
Findings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/headless.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/actions-runner.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.167.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.167 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.