registry / create-pmos / 0.411.0
create-pmos@0.411.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe high-risk credential match comes from a test that creates synthetic secret data and asserts the share service refuses it. The installer and plugin behavior are user-invoked, locally scoped, and gated where prompts can reach the external model service; no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI acts when a user runs it; outbound prompt classification requires the saved key, repository consent, and routing setting.
Impact
No harmful effect was confirmed in the inspected source.
Mechanism
The inspected code vendors local files and offers the bundled plugin through repository settings. Prompt routing uses the local workspace, which sends prompts to the model service only when its gates permit.
AI rationale
The high-risk credential match comes from a test that creates synthetic secret data and asserts the share service refuses it. The installer and plugin behavior are user-invoked, locally scoped, and gated where prompts can reach the external model service; no concrete attack behavior was found.
Network endpoints2
127.0.0.1api.typesafe.ai
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entry point, and its local kit and cockpit setup runs when that command is invoked.
- The cockpit installer offers a repository-local plugin from the bundled directory and merges settings without replacing existing values.
- The flagged credential locations are in a share test: it creates a synthetic key, checks that secret-bearing files are refused, and checks that files outside the workspace are not shared.
- The cockpit’s routing request is restricted to a loopback workspace address. The workspace sends prompts to the external model service only when a saved key, repository consent, and the routing setting are all present; prompts matching its secret scan are withheld.
- The other inspected files cover PMOS workflow, viewer, reporting, guard, and workspace functions. I found no concrete credential harvesting, destructive behavior, or stealth persistence in them.
Evidence against
- The workspace can send prompt text to api.typesafe.ai, but the inspected route requires all three gates and withholds prompts that match its secret scan.
- The installer can enable the bundled cockpit in repository Claude settings when the user runs the CLI; the setting points to the bundled local marketplace.
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/home-rows-test.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.411.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.411.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.