registry / @proagentstore/cli / 0.4.205
@proagentstore/cli@0.4.205
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 23h ago · by lpm-firewall-aiThe routed command execution and credential flows serve the package's stated agent CLI and diagnostics features. The newly added HTTPS probe sends a machine Git credential only to GitHub for a read-only permission check, and provider keys are used with their corresponding model APIs.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The executable loads the CLI when invoked; the inspected credential checks occur through diagnostics or model lookup features.
Impact
No unauthorized collection, unrelated credential transfer, or hidden account action was established.
Mechanism
The HTTPS probe makes a read-only GitHub API request to check push permission. Model lookup sends a provider key to that key's matching provider.
AI rationale
The routed command execution and credential flows serve the package's stated agent CLI and diagnostics features. The newly added HTTPS probe sends a machine Git credential only to GitHub for a read-only permission check, and provider keys are used with their corresponding model APIs.
Evidence
~/.config/proagentstore/session.jsonsite-builder/<runId>/broker.json
Network endpoints4
api.github.comapi.anthropic.comapi.openai.comgenerativelanguage.googleapis.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a CLI for creating, publishing, and running ProAgentStore agents; its executable is dist/bootstrap.js.
- The bootstrap loads the selected CLI payload when the command runs.
- The new HTTPS identity probe uses a Git credential for a read-only GitHub repository permission check; it says the credential is not returned, logged, or persisted.
- The probe is exposed through a coding diagnostics route and performs no push.
- Engine model lookup uses an environment API key for a request to that key's provider and says the key is used once and not returned.
Evidence against
- The source uses process execution, networking, and credentials, but the inspected uses support the CLI's agent and diagnostics functions.
- No install lifecycle scripts are declared in the manifest.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
10 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/windows-runner-live.jsView file
59busy: async (dir) => {
L60: const ps = spawnSync("powershell", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "Name='Runner.Worker.exe'" | Where-Object { $_.ExecutablePath -like '${dir.rep...
L61: return ps.status === 0 && Number.parseInt(String(ps.stdout).trim(), 10) > 0;
High
Shell
Package source references shell execution.
dist/browser-runner/coding/windows-runner-live.jsView on unpkg · L59Findings
2 Critical5 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/browser-runner/coding/https-push-identity.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/windows-runner-live.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.205.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.205 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.