create-pmos
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
This report shows the evidence for create-pmos@0.502.0. 1 of 372 known versions is blocked or flagged. The newest version, 0.533.0, is allowed. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe workspace starts model runs automatically when it detects qualifying metric gaps, using the user’s own login without a per-run request. Because this can consume the user’s model quota by default, the package meets the rule for malicious automatic use of a user’s resources.
Decision evidence
public snapshot- The metric-draft module describes runs that start “with no press” when workspace metrics or goals are missing.
- The workspace server’s periodic background loop calls metricDraftTick().
- The metric-draft tick scans workspaces and starts jobs for due scopes; its default behavior is disabled only by explicit off settings.
- An unpressed run is spawned headlessly with a prompt, using the user’s own login and model; headless runs cannot ask permission.
- The automatic drafts are limited to the PMOS metrics feature, and the package says only the user’s keep action writes a metric record.
- The feature can be disabled with PMOS_METRIC_DRAFT=off or PMOS_HEADLESS=off.
Source & flagged code
13 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.502.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing create-pmos@0.502.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.