create-pmos@0.495.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged CLI and agent-configuration behavior runs as part of an explicitly invoked setup command. The reviewed credential and prompt flows showed no collection to an unrelated host; the cockpit sends qualifying prompts only to the PMOS workspace’s loopback route when routing is enabled.
Decision evidence
public snapshot- The CLI performs scaffolding or workspace setup only after a user invokes a corresponding command.
- The cockpit setup adds its own bundled mod to the project’s Claude settings.
- Prompt routing uses only a loopback URL supplied by the PMOS workspace.
- A prompt is routed only when routing is enabled and the prompt passes the hook’s checks.
- The scanner flagged credential and command-execution patterns, but the reviewed paths did not show credentials sent to a foreign host.
- The CLI can write project agent settings, but that happens during an explicit scaffold or update command.
Source & flagged code
14 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.495.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.495.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.