create-pmos@0.491.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no install lifecycle script, and its CLI behavior is tied to explicit user commands. Prompt routing can transmit user prompts to the package’s fixed TypeSafe service, but requires a saved key, repository consent, and an enabled routing switch, and withholds credential-pattern matches and excluded paths.
Decision evidence
public snapshot- The manifest identifies a CLI package for scaffolding the PMOS kit; no lifecycle script is declared.
- The CLI dispatches to scaffolding or workspace setup when a user invokes a command.
- Prompt routing requires a valid key, repository consent, and the routing switch to be enabled.
- The documented routing switch is off until enabled; prompts go to Jev only when the stated conditions are met.
- The routing implementation withholds prompts that match credential patterns or excluded paths.
Source & flagged code
14 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.491.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.491.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.