registry / @wix/create-app / 0.0.235
@wix/create-app@0.0.235
Create Wix apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe static malicious hint is unsupported by the inspected source: no lifecycle hook or confirmed command-output exfiltration exists. The automatic project-scoped Wix skills installation remains a dangerous agent-extension capability that merits a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the @wix/create-app CLI and completing project generation without --skip-install.
Impact
Adds externally supplied agent skills to the new project and exposes normal CLI telemetry to Wix services.
Mechanism
Executes npx to add Wix AI skills; sends Wix CLI telemetry.
AI rationale
The static malicious hint is unsupported by the inspected source: no lifecycle hook or confirmed command-output exfiltration exists. The automatic project-scoped Wix skills installation remains a dangerous agent-extension capability that merits a warning.
Evidence
package.jsonbin/index.cjsbuild/index.jsbuild/generator-CWHZ3FKG.jstemplates/app/**.cursor/mcp.json.vscode/mcp.json.mcp.json
Network endpoints3
panorama.wixapps.net/api/v1/logfrog.wix.com22f50012d85a41e78a75ae13d92bd04f@o37417.ingest.sentry.io/4505232975593472
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- build/index.js automatically runs `npx --yes skills add wix/skills -y` after project generation unless `--skip-install` is used.
- The skills command is reached only when the user invokes the create-app CLI; package.json has no install lifecycle hook.
- build/index.js offers explicit IDE MCP configuration choices and scopes paths to the generated project directory.
- build/index.js posts CLI telemetry to Wix/Sentry endpoints during CLI execution.
Evidence against
- package.json contains no preinstall, install, or postinstall scripts.
- bin/index.cjs only checks Node version then imports build/index.js.
- No source-confirmed loopback command-output upload was found; child-process code includes bundled dependencies and intended CLI actions.
- MCP selection includes a visible “No” option and project-local config paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
8 flaggedbuild/chunk-6P5R3I5H.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-6P5R3I5H.jsView on unpkg · L24052321parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`];
L2322: parsed.command = process.env.comspec || "cmd.exe";
L2323: parsed.options.windowsVerbatimArguments = true;
High
build/index.jsView file
105__commonJS,
L106: __dirname,
L107: __esm,
...
L751: {
L752: name: "AppVeyor",
L753: constant: "APPVEYOR",
...
L1074: var vendors = require_vendors();
L1075: var env4 = process.env;
L1076: Object.defineProperty(exports, "_vendors", {
...
L1310: }
L1311: process26.exitCode = code || /* istanbul ignore next */
L1312: 0;
Findings
3 Critical4 High4 Medium6 Low
CriticalCommand Output Exfiltrationbuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
CriticalPrevious Version Dangerous Deltabuild/index.js
HighChild Processbuild/chunk-6P5R3I5H.js
HighShellbuild/chunk-6P5R3I5H.js
HighLoopback Host Fingerprint Telemetrybuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
Low
Affected versions and remediation
This report applies to @wix/create-app@0.0.235.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.235 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.