@chemx/starter-kit@26.9.11-362
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo automatic lifecycle attack is present, but the explicit scaffolder trusts remote file paths and mutates an AI-agent control file. This warrants a warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
The user runs a create or init CLI command and supplies or has a saved license key.
Impact
A compromised endpoint can place arbitrary template content or paths in the selected project; the agent rule can influence Cursor behavior in that project.
Mechanism
Remote template download followed by unchecked project writes and agent-rule creation.
AI rationale
No automatic lifecycle attack is present, but the explicit scaffolder trusts remote file paths and mutates an AI-agent control file. This warrants a warning rather than a publish block.
Evidence
cli/index.jscli/scaffold.jscli/license.js<selected-project>/<server-supplied relPath><selected-project>/.cursorrules~/.chemical-x/config.json~/.chemical-x/device_id
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The executable create and init commands invoke the scaffolder.
- The scaffolder writes every server-returned file path without validating that it stays inside the selected project directory.
- The create command adds a .cursorrules file containing agent instructions.
- The license request sends the entered license key and a persistent device ID to chemicalx.xophz.com.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The write and network paths require an explicit CLI create or init action.
- No self-dependency, credential harvesting beyond the supplied license key, or hidden command execution was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcecli/scaffold.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js';
import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js';
export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => {
renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)');
const licensekey = await obtainlicensekey(rawargs, onrunaudit);
if (!licensekey) {
process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n');
process.exit(1);
}
let targetname = projectname;
if (!targetname) {
targetname =
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
cli/scaffold.jsView on unpkg32const files = await fetchStarterKitFiles(licenseKey);
process.stdout.write(`Scaffolding Molecular Architecture into: \x1b[36m${finalDirName}/\x1b[0m\n`);
fs.mkdirSync(targetDir, { recursive: true });
for (const [relPath, content] of Object.entries(files)) {
const fullPath = path.join(targetDir, relPath);
const dirName = path.dirname(fullPath);
if (!fs.existsSync(dirName)) {
fs.mkdirSync(dirName, { recursive: true });
}
fs.writeFileSync(fullPath, content, 'utf-8');
process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`);
Medium
Ai Review Evidence
Findings
1 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencecli/index.js
MediumAi Review Evidencecli/scaffold.js
MediumAi Review Evidencecli/scaffold.js
MediumAi Review Evidencecli/license.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chemx/starter-kit@26.9.11-362.
See all versions of @chemx/starter-kit for other recorded verdicts.
- Review the evidence and your use of @chemx/starter-kit@26.9.11-362 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.