pomerado

AI Security Review

Evidence context: threat category none; evidence quality moderate.

No tool-poisoning findings matched anywhere in this package. That matters, because Pomerado is the shape of package that usually produces them: it mints integrations and runs a Guardian layer over an agent session, so its dist/typescript tree is full of tool registration metadata. None of that metadata carries directives aimed at a model. There are no strings telling an agent to stay quiet, skip confirmation, or reroute a call. The tool descriptions, where they exist, describe tools to a developer.

The credential findings are seven MCP-TRANSPORT-HARDCODED-TOKEN hits, and six sit in test material: dist/typescript/tests/browser/shop-fixture.js (four hits), dist/typescript/tests/support/credential-masking-corpus.js, and dist/typescript/tests/support/session-sign-in-contract.js. A file called credential-masking-corpus is a list of fake secrets used to prove a masking routine works, and a shop fixture is a pretend storefront for browser tests. Those are the last places anyone hides live credentials. The seventh hit is in dist/typescript/src/destinations/autofill-page-code.js, production code rather than a fixture, and that one cannot be verified from what we have. Nothing in this package reads ~/.ssh, ~/.aws/credentials, ~/.kube/config, or application_default_credentials.json. The credential-access rules produced no hits against those paths, and that is the pattern that would turn a token-shaped string into theft.

The network findings are ten NET-FETCH hits across dist/typescript/authoring/examples/kernel-page-fetch.js, dist/typescript/src/runtime/http-operation.js, dist/typescript/src/mint/secret-handle-guards.js, and dist/typescript/tests/browser/shop-fixture.js. Example code, an HTTP helper, a file whose name says it guards secret handles, and browser test scaffolding. The endpoint list tells the same story: address.city, button.click, control.page, co.uk and arg.as are property access chains and TLD fragments the extractor read as hosts, not servers the code calls. The code-smell bucket is similarly uninformative, since those rules fire on any bundled JavaScript, and nothing here needed string obfuscation or carried a malware signature.

The strongest counterargument is the production hit in autofill-page-code.js, paired with a publisher name, GitHub Actions, that says nothing about who wrote the package, and a 0.4.0-canary version. A credential autofill destination with a baked-in token deserves a look. It does not change the conclusion. One unexplained string in build output, with no exfiltration target behind it and no sensitive-path reads in the same tree, is a code-review task. The combination that defines theft, harvest plus a send to a host unrelated to the tool's job, is absent from every finding we have.

Key Reasons

• Zero tool-poisoning findings: no directives aimed at an AI agent appear in any tool metadata
• Six of seven hardcoded-token hits are in test fixtures and a credential-masking corpus, files that hold fake secrets by design
• No credential-access hits against .ssh, .aws/credentials, .kube/config or application_default_credentials.json
• Every NET-FETCH finding sits in example code, an HTTP runtime helper, a secret-handle guard, or browser test fixtures
• The endpoint list is property-chain and TLD-fragment noise (address.city, button.click, co.uk) rather than real hosts

False Positive Considerations

• IoC extractor read property access chains and TLD fragments (address.city, button.click, co.uk) as domains
• Code-smell rules fire on bundled dist/typescript output
• credential-masking-corpus.js and shop-fixture.js contain deliberate fake tokens as test data
• NET-FETCH matches are in examples/ and tests/, not in shipped request paths

Reviewed 2026-10-17; recommended action: monitor; model confidence 68%.