registry / claude-code-templates / 1.29.6
claude-code-templates@1.29.6
Component templates and tracking system for Claude Code
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected agent setup is tied to an explicit sandbox invocation and selected components, but it still installs behavior-bearing agent extensions and updates Claude project settings. Under the agent integration policy, this first-party extension setup warrants a warning; the inspected sources do not establish malicious credential redirection or an unconsented install-time attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running the Cloudflare sandbox launcher with agent components selected.
Impact
The selected agents become available to Claude Code in that project.
Mechanism
The launcher downloads selected agent files from the package's GitHub repository, writes them under .claude/agents, and writes project settings that reference them.
AI rationale
The inspected agent setup is tied to an explicit sandbox invocation and selected components, but it still installs behavior-bearing agent extensions and updates Claude project settings. Under the agent integration policy, this first-party extension setup warrants a warning; the inspected sources do not establish malicious credential redirection or an unconsented install-time attack.
Evidence
cli-tool/components/sandbox/cloudflare/launcher.tscli-tool/src/index.js
Network endpoints1
raw.githubusercontent.com/davila7/claude-code-templates/main/cli-tool/components/agents
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The root manifest exposes a CLI entry point and has no install lifecycle hook.
- The Cloudflare launcher installs requested agent files into the current project's .claude directory and writes settings that reference them.
- That installation downloads agent files from the package's GitHub repository and is triggered when components are supplied to the launcher.
- The CLI passes selected agent information into sandbox setup; this is a user-invoked package feature.
- Session cloning writes imported conversation data under the Claude project directory; the inspected proxy and file-operation locations do not establish credential redirection or an attack.
- The Docker executor installs components only when components are supplied.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggedcli-tool/components/sandbox/docker/execute.jsView file
10import path from 'path';
L11: import { spawn } from 'child_process';
L12:
High
Child Process
Package source references child process execution.
cli-tool/components/sandbox/docker/execute.jsView on unpkg · L10cli-tool/bin/create-claude-config.jsView file
2L3: const { program, Option } = require('commander');
L4: const chalk = require('chalk');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
cli-tool/bin/create-claude-config.jsView on unpkg · L2cli-tool/src/index.jsView file
Findings
8 High5 Medium4 Low
HighChild Processcli-tool/components/sandbox/docker/execute.js
HighShell
HighSame File Env Network Executioncli-tool/src/index.js
HighCredential Redirect Persistencecli-tool/src/index.js
HighExternal Ai Agent Control Surface Mutationcli-tool/components/sandbox/cloudflare/launcher.ts
HighTrigger Reachable External Ai Agent Control Surface Mutationcli-tool/src/index.js
HighSemantic Analysis Limitedcli-tool/package.json
HighPrevious Version Dangerous Deltacli-tool/src/index.js
MediumDynamic Requirecli-tool/bin/create-claude-config.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercli-tool/components/sandbox/e2b/e2b-monitor.py
Affected versions and remediation
This report applies to claude-code-templates@1.29.6.
See all versions of claude-code-templates for other recorded verdicts.
- Review the evidence and your use of claude-code-templates@1.29.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.