registry / create-pmos / 0.432.0
create-pmos@0.432.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged credential flow is a gated model-routing feature: prompts reach the external classifier only after the user enables repository consent and prompt routing, and the key remains in the workspace. The CLI's installation and configuration actions are invoked through explicit commands.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user starts the PMOS workspace and enables prompt routing with a saved TypeSafe key and repository consent; eligible prompts are then routed during the session.
Impact
The service classifies eligible prompts to suggest a model tier. The source does not show credential theft or unrelated account actions.
Mechanism
The cockpit sends the prompt and repository root to a loopback workspace endpoint. The workspace may send prompt text to its fixed TypeSafe endpoint after checking consent and screening for credentials and excluded paths.
AI rationale
The flagged credential flow is a gated model-routing feature: prompts reach the external classifier only after the user enables repository consent and prompt routing, and the key remains in the workspace. The CLI's installation and configuration actions are invoked through explicit commands.
Network endpoints2
127.0.0.1:<port>/api/model/routeapi.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI dispatches to vendoring, updating, or workspace installation based on the command the user runs.
- Prompt routing uses a PMOS_ROUTE_URL validated as a loopback address; the mod sends the repository root and prompt to that local service.
- The workspace requires a saved key, repository consent, and the prompt-routing switch, which is off by default; it withholds prompts that match credential patterns or excluded paths.
- Documentation discloses that opted-in prompt text may be sent to api.typesafe.ai and says the key stays on the user's machine.
Evidence against
- When routing is enabled and its consent gates are open, typed prompts and some sub-agent prompts are automatically submitted for model classification.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/board-shot.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.432.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.432.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.