@proagentstore/cli@0.4.201
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI automatically uploads bounded runtime stderr output in crash reports to its own service without a clear consent step. Because the report may contain tool output, this is suspicious undisclosed collection rather than a confirmed credential theft or unrelated-host exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The local browser runtime exits unexpectedly while launched through `pags up`.
Impact
Runtime or tool output in the tail may contain user data that the feature does not need to transmit for crash reporting.
Mechanism
The CLI stores a bounded stderr tail in a crash report and automatically sends pending reports with the user's session token.
AI rationale
The CLI automatically uploads bounded runtime stderr output in crash reports to its own service without a clear consent step. Because the report may contain tool output, this is suspicious undisclosed collection rather than a confirmed credential theft or unrelated-host exfiltration.
Evidence
dist/index.jsdist/browser-runner/crash-reports.js~/.config/proagentstore/runner-crashes-<account>.json~/.config/proagentstore/crash-delivered-<account>.json~/.config/proagentstore/browser-runner/crash-reports.json
Network endpoints1
api.proagentstore.online/v1/errors/runner-crashes
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the local runtime exits unexpectedly, the CLI captures its stderr tail for a crash report and attempts delivery before exiting.
- The CLI POSTs queued crash reports to ProAgentStore's `/v1/errors/runner-crashes` endpoint using the user's session token.
- Crash reports can include the last 20 output lines, with each line capped at 300 characters; those lines may contain user or tool output.
Evidence against
- The manifest declares no install, preinstall, or postinstall hooks; the package is an explicitly invoked CLI.
- The package's core purpose includes running a local browser runtime and connecting it to ProAgentStore, so its ordinary network and process use is expected.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/windows-runner-live.jsView file
59busy: async (dir) => {
L60: const ps = spawnSync("powershell", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "Name='Runner.Worker.exe'" | Where-Object { $_.ExecutablePath -like '${dir.rep...
L61: return ps.status === 0 && Number.parseInt(String(ps.stdout).trim(), 10) > 0;
High
Shell
Package source references shell execution.
dist/browser-runner/coding/windows-runner-live.jsView on unpkg · L59Findings
2 Critical5 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/repo-clone-job.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/windows-runner-live.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.201.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.201 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.