create-pmos@0.464.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged prompt transport is an opt-in model-routing feature: the mod reaches only the local workspace, and external classification requires a saved key, per-repository consent, and a routing switch that defaults off. The reviewed credential is sent to its named service, with prompt secret and excluded-path checks before transmission.
Decision evidence
public snapshot- The package exposes a command-line entrypoint whose behavior is selected by explicit command arguments.
- The cockpit mod routes eligible prompts through a loopback-only workspace URL.
- The external TypeSafe classification path requires a saved key, repository consent, and a routing switch that defaults off; prompts matching secret rules or excluded paths are withheld.
- The TypeSafe client uses the fixed host api.typesafe.ai and sends the key in an authorization header to that service.
Source & flagged code
11 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.464.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.464.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.