create-pmos@0.497.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no lifecycle scripts, and its agent configuration changes occur through an explicitly invoked scaffolding command. The reviewed credential and prompt flows support the package’s own workspace and routing features; no concrete malicious behavior was found.
Decision evidence
public snapshot- The package exposes an explicit CLI; its default behavior is to scaffold the kit when invoked.
- The CLI offers the cockpit mod through repository-local Claude settings, with an option to skip it; the mod uses a bundled local marketplace.
- Prompt routing is off unless enabled by a person, and the mod sends prompts to a workspace-provided loopback endpoint; the workspace holds the routing key.
- The workspace uses the Anthropic key for Claude API runs, consistent with the product’s own API feature.
- No lifecycle scripts are declared in package.json.
- No source evidence reviewed showed credentials being sent to an unrelated host or an install-time data collection flow.
Source & flagged code
13 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.497.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.497.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.