registry / @proagentstore/cli / 0.4.174
@proagentstore/cli@0.4.174
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and inspected runtime behavior ties dynamic loading, network access, and child-process execution to CLI updates and runner features. The scanner signals do not establish malicious behavior in these source paths.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs a CLI command, such as `pags up`, or invokes a runner-management route.
Impact
These inspected operations support the package's CLI and runner features; no unrelated credential transfer or unconsented install-time mutation was found.
Mechanism
The CLI may update its own payload during `pags up`; runner-management code downloads and configures a GitHub Actions runner when its install route is called.
AI rationale
The manifest has no install lifecycle hook, and inspected runtime behavior ties dynamic loading, network access, and child-process execution to CLI updates and runner features. The scanner signals do not establish malicious behavior in these source paths.
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI through dist/bootstrap.js and lists build, dev, and typecheck scripts, with no install lifecycle hook.
- The bootstrap checks for updates only when the user runs `pags up`, then loads the selected CLI payload.
- The runner install and removal jobs are started through explicit actions-runner routes; the install flow fetches the GitHub Actions runner release.
- The repository and terminal modules use child processes for runner and terminal operations; the inspected sources show no unrelated attack behavior.
- The inspected dependency manifests and entrypoints show no install scripts in commander or chalk; their source is ordinary CLI parsing and terminal styling.
Evidence against
- The scanner flags execution, networking, and dynamic loading, but inspected call sites place them in CLI update, runner-management, and terminal functionality.
- No confirmed credential export, unconsented lifecycle mutation, or unrelated account action was identified in the inspected source.
Behavioral surface
ChildProcess
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/actions-runner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @proagentstore/cli@0.4.167
matchedIdentity = npm:QHByb2FnZW50c3RvcmUvY2xp:0.4.167
similarity = 0.980
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/browser-runner/coding/actions-runner.jsView on unpkgFindings
1 Critical6 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/actions-runner.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/actions-runner.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.174.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.174 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.