registry / create-pmos / 0.439.0
create-pmos@0.439.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged credential flow sends GITHUB_TOKEN only to GitHub’s API for Portable Git release metadata. The prompt-routing path is opt-in, requires repository consent and a saved key, and keeps that key out of the agent environment.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Scaffolding and workspace setup run when the user invokes the CLI; prompt routing requires explicit user enablement and repository consent.
Impact
No unauthorized collection, credential exposure, or unrelated execution was found in the reviewed paths.
Mechanism
The Windows installer uses a GitHub token only for GitHub release metadata. Optional prompt routing uses a loopback workspace endpoint, which holds the TypeSafe key outside the agent environment.
AI rationale
The flagged credential flow sends GITHUB_TOKEN only to GitHub’s API for Portable Git release metadata. The prompt-routing path is opt-in, requires repository consent and a saved key, and keeps that key out of the agent environment.
Evidence
pmos/.pmos-profile.gitattributes.claude/settings.json.claude/skills
Network endpoints2
api.github.com127.0.0.1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI runs its scaffold, update, or workspace actions based on explicit command-line arguments.
- Prompt routing requires a saved key, repository consent, and an opt-in switch that defaults off; prompts that fail the secret scan are withheld.
- The cockpit sends routing requests to the workspace over loopback, and the workspace removes the TypeSafe key from the agent process environment.
- The installer sends GITHUB_TOKEN as authorization only to api.github.com to fetch Portable Git release metadata.
- The cockpit configuration points Claude Code to the bundled local pmos/mods directory.
Evidence against
- The manifest describes a bundled scaffold and local companion app; no lifecycle scripts are declared.
- The routing code only acts when routing is enabled, and a terminal outside the PMOS workspace has no routing endpoint.
- The GitHub request supports downloading Portable Git from its official release service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/adler-moments-test.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.439.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.439.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.