registry / create-pmos / 0.447.0
create-pmos@0.447.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged credential flow sends GITHUB_TOKEN to GitHub's own release API, and there is no package lifecycle hook in the manifest. The potentially sensitive prompt-routing feature is documented, uses a loopback bridge, and sends prompts to Jev only after three gates are enabled.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI to scaffold or update a kit, or separately enables prompt routing in the workspace.
Impact
No unauthorized credential transfer or unrelated account action was found. GitHub credentials in the Windows installer are sent to GitHub's release API for an asset lookup.
Mechanism
The scaffold copies files and offers its own plugin in project settings. Prompt routing posts to a loopback workspace endpoint; Jev receives prompt text only when the saved-key, consent, and routing gates are all open.
AI rationale
The flagged credential flow sends GITHUB_TOKEN to GitHub's own release API, and there is no package lifecycle hook in the manifest. The potentially sensitive prompt-routing feature is documented, uses a loopback bridge, and sends prompts to Jev only after three gates are enabled.
Evidence
target/pmos/**.claude/settings.json.claude/skills/**
Network endpoints3
api.github.com/repos/git-for-windows/git/releases/latest127.0.0.1:<port>/api/model/routeunpkg.com/create-pmos/install.sh
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is a CLI for scaffolding the PMOS kit; its entry point copies the bundled payload into the requested target directory.
- The flagged Windows installer sends GITHUB_TOKEN as an Authorization header to GitHub's own release API while looking up Git for Windows.
- Prompt routing uses the workspace's loopback endpoint; sending prompts to Jev requires a saved key, repository consent, and a routing switch that defaults off.
Evidence against
- When explicitly run, the scaffold command offers the package's cockpit plugin through the repository's Claude settings.
- With all routing gates enabled, prompt text can be sent for classification, though the package documents this behavior and screens secrets first.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/adler-moments-test.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.447.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.447.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.