create-pmos@0.519.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe package has no install lifecycle scripts, and its CLI performs scaffolding only when invoked by the user. The flagged prompt flow uses a workspace-provided route, while the inspected source showed no automatic credential exfiltration or unrelated external collector.
Decision evidence
public snapshot- The manifest describes a scaffolding CLI and exposes bin/create-pmos.js; it declares no lifecycle scripts.
- The CLI copies the bundled kit into a target repository when the user runs its vendor command.
- The cockpit settings entry points to the local ./pmos/mods directory and enables that plugin.
- Prompt routing uses PMOS_ROUTE_URL supplied by the workspace and does nothing when it is absent.
Source & flagged code
25 flaggedPackage contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23Package source references shell execution.
bin/create-pmos.jsFindings
Affected versions and remediation
This report applies to create-pmos@0.519.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.519.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.