registry / create-pmos / 0.486.0
create-pmos@0.486.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential and network flows resolve to an optional prompt-routing feature with consent gates and secret-pattern filtering. Agent configuration is added by the user-run scaffolding command and points to the package’s bundled plugin.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the CLI; prompt routing additionally requires a saved TypeSafe key, repository consent, and an enabled routing switch.
Impact
No malicious impact identified. Opted-in prompt classification can disclose eligible prompt text to the configured service.
Mechanism
The CLI copies the bundled kit and can register its local cockpit plugin. With routing enabled, eligible prompts are sent for classification through the workspace and its fixed TypeSafe endpoint.
AI rationale
The flagged credential and network flows resolve to an optional prompt-routing feature with consent gates and secret-pattern filtering. Agent configuration is added by the user-run scaffolding command and points to the package’s bundled plugin.
Evidence
.claude/settings.json.claude/skills/<name>
Network endpoints2
127.0.0.1:<port>/api/model/routeapi.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI runs vendoring, updating, or workspace setup through explicit command branches; its default branch calls the vendoring function.
- Vendoring offers the cockpit plugin in the repository’s Claude settings, and the plugin’s marketplace and enablement entries point to the bundled PMOS directory.
- Prompt routing requires a saved key, repository consent, and the routing switch.
- Before routing, the workspace withholds prompts matching secret patterns or excluded paths; its documentation says prompt routing is off until enabled and describes what is sent.
- The TypeSafe endpoint is fixed in source at api.typesafe.ai/v1/systemone.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
13 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
1 Critical7 High7 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighEvalworkspace/public/vendor/pdf.worker.min.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.486.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.486.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.