claude-code-templates@1.29.7
Component templates and tracking system for Claude Code
AI Security Review
scanned 24d ago · by lpm-firewall-aiStatic inspection found an explicit user-invoked agent installation capability that writes files into `.claude/agents`, so this merits a warning under the agent capability policy. The inspected source does not establish covert execution, credential theft, or malicious install-time behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes the Cloudflare sandbox flow with agent components selected.
Impact
Selected agent definitions become active in the project configuration.
Mechanism
The launcher downloads agent files from raw.githubusercontent.com and writes them under the project’s .claude/agents directory.
AI rationale
Static inspection found an explicit user-invoked agent installation capability that writes files into `.claude/agents`, so this merits a warning under the agent capability policy. The inspected source does not establish covert execution, credential theft, or malicious install-time behavior.
Evidence
cli-tool/components/sandbox/cloudflare/launcher.ts.claude/agents/
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Cloudflare sandbox flow can install selected agent definitions into the project’s `.claude/agents` directory from the package publisher’s GitHub repository.
- The install is reachable when the user invokes the Cloudflare sandbox flow and supplies agent components; source inspection found no npm install lifecycle hook.
Evidence against
- The manifest exposes the CLI and main module, and its only lifecycle script is `prepublishOnly`, which checks version synchronization.
- The session-sharing path validates imported conversation IDs before writing session files; the local API proxy restricts requests to loopback hosts without an Origin header.
- The agent-file installation is tied to selected components in an explicit CLI flow, rather than an npm installation hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggedcli-tool/components/sandbox/docker/execute.jsView file
10import path from 'path';
L11: import { spawn } from 'child_process';
L12:
High
Child Process
Package source references child process execution.
cli-tool/components/sandbox/docker/execute.jsView on unpkg · L10cli-tool/src/index.jsView file
2754stdio: ['inherit', 'inherit', 'inherit'],
L2755: shell: true
L2756: });
High
3163L3164: const sandboxExecution = spawn('npx', [
L3165: 'tsx',
...
L3169: anthropicKey,
L3170: 'http://localhost:8787', // Local dev server URL
L3171: targetDir // Project root directory for file output
...
L3176: env: {
L3177: ...process.env,
L3178: ANTHROPIC_API_KEY: anthropicKey
Findings
7 High5 Medium5 Low
HighChild Processcli-tool/components/sandbox/docker/execute.js
HighShellcli-tool/src/index.js
HighSame File Env Network Executioncli-tool/src/index.js
HighCredential Redirect Persistencecli-tool/src/index.js
HighExternal Ai Agent Control Surface Mutationcli-tool/components/sandbox/cloudflare/launcher.ts
HighTrigger Reachable External Ai Agent Control Surface Mutationcli-tool/src/index.js
HighPrevious Version Dangerous Deltacli-tool/src/index.js
MediumDynamic Requirecli-tool/bin/create-claude-config.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercli-tool/components/sandbox/e2b/e2b-monitor.py
Affected versions and remediation
This report applies to claude-code-templates@1.29.7.
See all versions of claude-code-templates for other recorded verdicts.
- Review the evidence and your use of claude-code-templates@1.29.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.