@wix/create-app@0.0.259
Create Wix apps
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source establishes explicit-command agent setup and default external skills installation, supporting a behavior-specific warning. Project-local scope, interactive MCP selection, and the absence of npm installation hooks do not support a malware block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running project creation without skipping dependency installation activates skills setup; choosing an IDE activates MCP configuration generation.
Impact
Agent instructions and MCP capabilities can be introduced into the generated project. IDE consent permits later client retrieval when the MCP server starts, but no persistent automatic update preference was identified.
Mechanism
The CLI runs an external skills installer in the project directory and renders IDE-specific configuration that launches an unpinned Wix MCP client through npx.
AI rationale
Inspected source establishes explicit-command agent setup and default external skills installation, supporting a behavior-specific warning. Project-local scope, interactive MCP selection, and the absence of npm installation hooks do not support a malware block.
Evidence
build/index.jsbuild/generator-EQDRKT2I.jstemplates/app/.cursor/mcp.json.ejs.cursor/mcp.json.vscode/mcp.json.mcp.json
Network endpoints1
mcp.wix.com/sse
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Project creation runs npx skills add wix/skills with confirmation prompts disabled in the generated project directory.
- The skills installation task runs unless dependency installation is skipped; skipping defaults to false.
- Interactive IDE selection enables project-local MCP configuration for Cursor, VS Code, or Claude Code.
- The template generator honors conditional skips and writes the selected configuration; the Cursor template runs @wix/mcp-remote against https://mcp.wix.com/sse.
- package.json contains no npm installation lifecycle hooks or runtime self-dependency.
Evidence against
- The agent setup occurs through an explicit project-creation command, rather than an npm installation hook.
- MCP selection is interactive, configuration paths are project-local, and the gateway belongs to Wix.
- No concrete credential theft, destructive action, or covert persistence was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
9 flaggedbuild/index.jsView file
105__commonJS,
L106: __dirname,
L107: __esm,
...
L751: {
L752: name: "AppVeyor",
L753: constant: "APPVEYOR",
...
L1074: var vendors = require_vendors();
L1075: var env4 = process.env;
L1076: Object.defineProperty(exports, "_vendors", {
...
L1310: }
L1311: process26.exitCode = code || /* istanbul ignore next */
L1312: 0;
Critical
Download Execute
Source downloads or fetches remote code and executes it.
build/index.jsView on unpkg · L105105Trigger-reachable chain: manifest.bin -> bin/index.cjs -> bin/import.cjs -> build/index.js
L105: __commonJS,
L106: __dirname,
L107: __esm,
...
L751: {
L752: name: "AppVeyor",
L753: constant: "APPVEYOR",
...
L1074: var vendors = require_vendors();
L1075: var env4 = process.env;
L1076: Object.defineProperty(exports, "_vendors", {
...
L1310: }
L1311: process26.exitCode = code || /* istanbul ignore next */
L1312: 0;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
build/index.jsView on unpkg · L10519105"node:buffer": [">= 14.18 && < 15", ">= 16"],
L19106: child_process: true,
L19107: "node:child_process": [">= 14.18 && < 15", ">= 16"],
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/index.js
HighEvalbuild/generator-EQDRKT2I.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-EQDRKT2I.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.259.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.259 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.