registry / create-pmos / 0.407.0
create-pmos@0.407.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe CLI automatically enables a bundled agent extension during project setup, and that extension can route prompts for classification. The data path is local-first and gated by explicit workspace consent and routing settings, supporting a warning for agent extension setup rather than a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the create-pmos scaffolder; prompt routing is triggered by submitted prompts while the extension is active.
Impact
The extension adds agent behavior to the project and may disclose eligible prompt text to Jev under the configured routing consent. No credential theft or unguarded external transfer was identified.
Mechanism
The scaffolder merges the extension marketplace and enabled-plugin entries into the repository settings. The extension forwards eligible prompts to the loopback workspace, which can send them to Jev only when routing is enabled and consent and key requirements are met.
AI rationale
The CLI automatically enables a bundled agent extension during project setup, and that extension can route prompts for classification. The data path is local-first and gated by explicit workspace consent and routing settings, supporting a warning for agent extension setup rather than a confirmed attack.
Evidence
bin/create-pmos.jsbin/cockpit-install.jspayload/mods/pmos-cockpit/hooks/register.tsxpayload/mods/pmos-cockpit/hooks/lib/route.mjsworkspace/server.jsworkspace/lib/jev-route.js.claude/settings.json
Network endpoints1
127.0.0.1:<port>/api/model/route
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the scaffolder vendors the kit and offers its cockpit extension by adding a marketplace entry and enabling the plugin in project settings.
- The extension routes typed prompts and agent prompts when routing is on; the session routing state defaults to on.
- Prompt content can reach Jev for classification when routing policy is enabled and the saved key, repository consent, and routing switch are all present.
- The document reader fetches text using same-origin credentials.
- The guard classifies a path using the supplied root and layout context.
- The status-line helper removes unsafe control characters and trims text.
- The handover planner refuses to plan a commit and push on the default branch.
- The handover runner stages only the paths supplied in its plan.
Evidence against
- The routing request is restricted to a loopback workspace endpoint; the plugin does not send prompts to an arbitrary host.
- The workspace withholds prompts that match its secret scan or excluded paths, and sends none when any required gate is closed.
Behavioral surface
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/briefing-premium-doc-edit-test.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
Medium
Affected versions and remediation
This report applies to create-pmos@0.407.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.407.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.