registry / @proagentstore/cli / 0.4.95
@proagentstore/cli@0.4.95
CLI for creating, publishing, and running ProAgentStore agents
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged shell and process execution are part of user-configured runner restart, repository, or local task functions. Inspected credential and network use is directed to the package service or a caller-supplied repository destination; no concrete attack behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation does not trigger these operations; they require a CLI command or a submitted runner task.
Impact
No unauthorized credential transfer, destructive action, or unconsented install-time mutation was found.
Mechanism
The package validates task input, uses workspace paths and caller-supplied repository details, and sends login credentials to its own service for validation.
AI rationale
The manifest has no install hook, and the flagged shell and process execution are part of user-configured runner restart, repository, or local task functions. Inspected credential and network use is directed to the package service or a caller-supplied repository destination; no concrete attack behavior was established.
Network endpoints1
api.proagentstore.online
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the command-line entry point and only build, development, and type-check scripts; it has no install lifecycle hook.
- The bootstrap checks for updates only when the user runs the runner command and loads the selected bundled or cached package payload.
- Saved login sessions are sent to the package's ProAgentStore API host for authentication validation.
- Local artifact tasks validate their input, read selected workspace files, write under the workspace applications directory, and launch a configured local CLI.
- Repository cloning requires a supplied work directory and clone URL; it uses fixed git arguments and adds a supplied token only to HTTPS clone URLs.
- The shell restart path requires a configured restart command and runs as part of runner restart handling.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
7 flaggeddist/browser-runner/local-artifact/runtime.jsView file
22*/
L23: import { spawn as nodeSpawn } from "node:child_process";
L24: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/local-artifact/runtime.jsView on unpkg · L22dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @proagentstore/cli@0.4.50
matchedIdentity = npm:QHByb2FnZW50c3RvcmUvY2xp:0.4.50
similarity = 0.462
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1286if (restarter === "command") {
L1287: deps.spawn(process.env[RESTART_COMMAND_ENV], { shell: true, detached: true, stdio: "ignore", env: process.env }).unref();
L1288: deps.exit(0);
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/browser-runner/local-artifact/runtime.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.95.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.95 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.