registry / create-pmos / 0.448.0
create-pmos@0.448.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe agent-setting change is limited to this package’s own plugin in a project scaffolded by an explicit CLI command; the package also supports skipping the offer. The flagged prompt flow is opt-in and credential-gated, so the source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user explicitly runs the create-pmos CLI; routing requires the user to enable it for the session.
Impact
The plugin is offered to Claude Code in the scaffolded project. No unauthorized credential transfer or other attack behavior was identified.
Mechanism
Scaffolding adds the package’s local plugin marketplace and enabled plugin entries to the project’s Claude settings. With routing enabled, eligible prompts go to a loopback workspace endpoint; remote classification additionally requires a saved key, repository consent, and the route switch.
AI rationale
The agent-setting change is limited to this package’s own plugin in a project scaffolded by an explicit CLI command; the package also supports skipping the offer. The flagged prompt flow is opt-in and credential-gated, so the source does not establish malicious behavior.
Evidence
.claude/settings.json
Network endpoints1
127.0.0.1:<port>/api/model/route
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI’s normal scaffolding flow offers the package’s own cockpit mod through the repository settings; users can skip it with `--no-mod`.
- The mod adds only its own local marketplace and enabled plugin entries, and merges them into `.claude/settings.json` without replacing existing values.
- Prompt routing is off by default and requires a saved key and repository consent before a prompt can be sent for classification.
Evidence against
- The manifest has no lifecycle scripts; the package runs through its explicitly invoked CLI.
- The flagged outbound request is limited to the workspace’s loopback route endpoint, and only runs when routing is enabled for eligible prompts.
- The workspace keeps its TypeSafe key out of the agent process environment.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
12 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical6 High6 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/adler-moments-test.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.448.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.448.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.