@proagentstore/cli@0.4.194
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe runner automatically sends a bounded tail of its local update log with status, and update failures can add local diagnostic details to that log. This is a limited runtime telemetry concern; the reviewed source shows no install hook or unrelated credential destination.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An authenticated runner starts and reports update status during `pags up`.
Impact
Update failure details may reveal local diagnostic information, such as paths included in error messages.
Mechanism
The CLI reads up to 4,000 characters from its update log, masks common secret patterns, and includes the result in a status request.
AI rationale
The runner automatically sends a bounded tail of its local update log with status, and update failures can add local diagnostic details to that log. This is a limited runtime telemetry concern; the reviewed source shows no install hook or unrelated credential destination.
Evidence
dist/chunk-RXYCTIBD.jsdist/index.js~/.config/proagentstore/update.log
Network endpoints1
api.proagentstore.online
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runner reads a local update-log tail, masks common secret patterns, and limits it to 4,000 characters.
- Runner status includes that log tail, and the authenticated status request sends it to the ProAgentStore API.
- Update failure messages are written into the log and may contain local diagnostic details.
- The package manifest declares no install lifecycle script.
- The engine model-list code sends provider keys to the corresponding provider API.
- For local application runs, diagnostics pass signal IDs rather than the matched lines of engine output.
Evidence against
- The log upload occurs as part of the authenticated runner’s platform status reporting.
- The reviewed source shows no install-time data collection or external contact.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
10 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/windows-runner-live.jsView file
59busy: async (dir) => {
L60: const ps = spawnSync("powershell", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "Name='Runner.Worker.exe'" | Where-Object { $_.ExecutablePath -like '${dir.rep...
L61: return ps.status === 0 && Number.parseInt(String(ps.stdout).trim(), 10) > 0;
High
Shell
Package source references shell execution.
dist/browser-runner/coding/windows-runner-live.jsView on unpkg · L59Findings
2 Critical5 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/browser-runner/local-apply/runtime.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/windows-runner-live.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.194.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.194 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.