registry / @proagentstore/cli / 0.4.190
@proagentstore/cli@0.4.190
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged capabilities are consistent with a CLI that runs agents and manages runners, and the inspected credential flows go to the relevant service or matching provider. I found no install-time behavior or concrete malicious exfiltration in the reviewed source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user invokes the CLI commands to sign in, start a runner, or manage agent and runner tasks.
Impact
No malicious impact is established by the inspected source.
Mechanism
The CLI communicates with ProAgentStore and matching AI providers, and can install or run a GitHub Actions runner when requested.
AI rationale
The flagged capabilities are consistent with a CLI that runs agents and manages runners, and the inspected credential flows go to the relevant service or matching provider. I found no install-time behavior or concrete malicious exfiltration in the reviewed source.
Network endpoints4
api.proagentstore.onlineapi.anthropic.comapi.openai.comgithub.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a CLI for creating, publishing, and running ProAgentStore agents; its bin is the bootstrap CLI.
- The saved session token is validated against api.proagentstore.online, the package’s own service.
- Engine model discovery sends Anthropic and OpenAI keys only to their matching providers’ model-list endpoints; the code says the key is used for that request and not returned.
- The Actions runner installer downloads releases from GitHub’s official actions/runner release path.
Evidence against
- The package exposes command execution, a WebSocket relay, and persistent runner/service options, which are powerful capabilities but fit its agent-runner purpose.
- There are no install, preinstall, or postinstall lifecycle hooks in the manifest.
- The scanner’s credential-host leads resolve to provider-matching model-list calls or ordinary GitHub token handling, not evidence of unrelated credential exfiltration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/windows-runner-live.jsView file
59busy: async (dir) => {
L60: const ps = spawnSync("powershell", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "Name='Runner.Worker.exe'" | Where-Object { $_.ExecutablePath -like '${dir.rep...
L61: return ps.status === 0 && Number.parseInt(String(ps.stdout).trim(), 10) > 0;
High
Shell
Package source references shell execution.
dist/browser-runner/coding/windows-runner-live.jsView on unpkg · L59Findings
2 Critical5 High5 Medium4 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/actions-runner.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/windows-runner-live.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.190.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.190 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.