create-pmos@0.420.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged prompt flow is restricted to the local workspace, which requires a saved key, repository consent, and routing to be enabled before sending prompt text externally. The configuration changes offer this package's own local plugin when the user runs the scaffolding command.
Decision evidence
public snapshot- The package is a PMOS scaffolder; its command dispatch runs when the user invokes the CLI.
- Prompt routing requires a saved key, repository consent, and the routing switch to be enabled.
- The routing hook accepts only a loopback workspace URL; the workspace handles any external request.
- The Claude configuration adds this package's local PMOS marketplace and cockpit plugin.
Source & flagged code
12 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.420.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.420.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.