registry / create-pmos / 0.408.0
create-pmos@0.408.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and the credential-related finding inspected is a test that verifies secret rejection. The explicit scaffolder can automatically enable a project-local agent plugin, so I am warning about the agent extension setup without concluding that the package is malicious.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the create-pmos scaffolding command without --no-mod.
Impact
The plugin becomes available to Claude Code for that project and can affect tool-call decisions. No credential theft or malicious account action was established.
Mechanism
The CLI merges marketplace and enabled-plugin entries into the repository’s .claude/settings.json. The plugin registers tool-call guards and commands; the inspected handover requires typed confirmation.
AI rationale
The manifest has no lifecycle scripts, and the credential-related finding inspected is a test that verifies secret rejection. The explicit scaffolder can automatically enable a project-local agent plugin, so I am warning about the agent extension setup without concluding that the package is malicious.
Evidence
.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the scaffolder calls the mod offer, which can add the mod to the repository’s Claude settings.
- The installer enables a project-local Claude plugin and writes missing settings values.
- The plugin intercepts tool calls and can deny them; outward writes require confirmation each time.
- Handover commits or pushes only after a person types the confirmation or presses the control.
- The credential-looking share test creates a fake secret and checks that the share request is refused.
- The viewer fetches a located document using the workspace and relative path returned by its locator.
- The tool classifier maps recognized pull request merge and auto-merge tool names to merge findings.
- The status formatter builds a display line from the initiative ID and stage, cleaning it to the selected width.
Evidence against
- The package manifest exposes a CLI and lists no lifecycle scripts.
- The scaffolder provides a --no-mod option, and the plugin’s setup is part of an explicit command.
- The inspected credential-related test exercises secret rejection; it does not show credentials being sent to an external recipient.
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/home-other-product-test.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
Medium
Affected versions and remediation
This report applies to create-pmos@0.408.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.408.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.