chemx@26.9.11-362
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe explicit scaffold operation creates an AI-agent control file and writes remotely supplied content, so it warrants a warning. Source inspection found no automatic install trigger, self-dependency chain, credential harvesting, or covert exfiltration.
Static reason
No blocking static signals were detected.
Trigger
The user runs a create, init, or audit CLI command.
Impact
A user who invokes scaffolding accepts server-supplied project files and AI-agent instructions; audit changes local repository metadata.
Mechanism
Remote scaffold download and explicit project configuration writes.
AI rationale
The explicit scaffold operation creates an AI-agent control file and writes remotely supplied content, so it warrants a warning. Source inspection found no automatic install trigger, self-dependency chain, credential harvesting, or covert exfiltration.
Evidence
cli/scaffold.jscli/license.jscli/audit/history.js<selected-project>/<server-supplied-relative-path><selected-project>/.cursorrules<current-project>/.chemx<current-project>/.gitignore~/.chemical-x/config.json~/.chemical-x/device_id
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit scaffold command downloads server-provided files and writes them into the chosen project directory.
- Scaffolding creates a Cursor rules file that directs AI agents to follow package-authored architecture rules.
- A user-supplied license key and generated device identifier are sent to the package service before scaffold files are returned.
- Running an audit automatically creates local state and can append an ignore rule to the current repository.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The command dispatcher reaches scaffolding only through explicit create-style CLI invocation.
- No runtime dependency on chemx itself is declared.
- The GitHub token path is used for the explicit report-sharing feature, not during installation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcecli/scaffold.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js';
import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js';
export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => {
renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)');
const licensekey = await obtainlicensekey(rawargs, onrunaudit);
if (!licensekey) {
process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n');
process.exit(1);
}
let targetname = projectname;
if (!targetname) {
targetname =
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
cli/scaffold.jsView on unpkg37for (const [relPath, content] of Object.entries(files)) {
const fullPath = path.join(targetDir, relPath);
const dirName = path.dirname(fullPath);
if (!fs.existsSync(dirName)) {
fs.mkdirSync(dirName, { recursive: true });
}
fs.writeFileSync(fullPath, content, 'utf-8');
process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`);
}
Medium
Ai Review Evidence
The explicit scaffold command downloads server-provided files and writes them into the chosen project directory.
cli/scaffold.jsView on unpkg · L37Findings
1 High6 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencecli/scaffold.js
MediumStripped Provenance Metadatacli/scaffold.js
MediumAi Review Evidencecli/license.js
MediumAi Review Evidencecli/audit/history.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to chemx@26.9.11-362.
See all versions of chemx for other recorded verdicts.
- Review the evidence and your use of chemx@26.9.11-362 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.