@proagentstore/cli@0.4.207
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 21h ago · by lpm-firewall-aiThe runner sends host telemetry to its own service, including the local home directory path, which makes this runtime telemetry suspicious under the review rules. The flagged engine-key flow is for model-list requests to the corresponding AI provider, and I found no evidence that it sends those keys to a foreign host.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user starts the runner with `pags up`, which sends runtime heartbeats.
Impact
The service receives a local path that can identify the user or machine.
Mechanism
Host sampling records `homedir()` in resource data, which is included in the authenticated heartbeat sent to the ProAgentStore API.
AI rationale
The runner sends host telemetry to its own service, including the local home directory path, which makes this runtime telemetry suspicious under the review rules. The flagged engine-key flow is for model-list requests to the corresponding AI provider, and I found no evidence that it sends those keys to a foreign host.
Evidence
dist/index.js
Network endpoints1
api.proagentstore.online/v1/instances/{id}/runtime/heartbeat
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The runner’s host telemetry includes the machine’s home directory path.
- The runner includes sampled resources in its authenticated runtime heartbeat.
- The heartbeat uses the ProAgentStore API by default.
Evidence against
- The package is a CLI for creating, publishing, and running ProAgentStore agents.
- The heartbeat is part of the runner’s machine-status reporting.
- Engine model-list requests use the corresponding provider API key and provider endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/windows-runner-live.jsView file
59busy: async (dir) => {
L60: const ps = spawnSync("powershell", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "Name='Runner.Worker.exe'" | Where-Object { $_.ExecutablePath -like '${dir.rep...
L61: return ps.status === 0 && Number.parseInt(String(ps.stdout).trim(), 10) > 0;
High
Shell
Package source references shell execution.
dist/browser-runner/coding/windows-runner-live.jsView on unpkg · L59Findings
1 Critical5 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/windows-runner-live.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/actions-runner.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.207.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.207 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.