registry / claude-code-templates / 1.30.0
claude-code-templates@1.30.0
Component templates and tracking system for Claude Code
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest's only lifecycle hook is a prepublish version check, while the inspected configuration and session writes are tied to CLI features. No concrete malicious behavior was found in the required source paths.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI to configure templates, clone a session, install an agent, or run a sandbox.
Impact
No unconsented credential forwarding, install-hook mutation, or other concrete attack was established.
Mechanism
Those flows write product-related Claude configuration or session files, download requested agent content, and pass a supplied API key to the selected Claude service or sandbox SDK.
AI rationale
The manifest's only lifecycle hook is a prepublish version check, while the inspected configuration and session writes are tied to CLI features. No concrete malicious behavior was found in the required source paths.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and has only a prepublishOnly hook, which checks version synchronization.
- The Cloudflare launcher stores downloaded agents in the Claude configuration directory as part of its agent installation flow.
- The API proxy is initialized with local session state and its source restricts requests to loopback hosts without an Origin header.
- File operations inspect existing project Claude configuration paths as part of the template setup flow.
- Session cloning is an explicit CLI option, and session installation validates the conversation ID before writing a project session file.
- The Docker sandbox passes a caller-provided Anthropic key to the Agent SDK; the install UI lists the available configuration destinations.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
10 flaggedcli-tool/components/sandbox/docker/execute.jsView file
10import path from 'path';
L11: import { spawn } from 'child_process';
L12:
High
Child Process
Package source references child process execution.
cli-tool/components/sandbox/docker/execute.jsView on unpkg · L10cli-tool/src/index.jsView file
2674stdio: ['inherit', 'inherit', 'inherit'],
L2675: shell: true
L2676: });
High
3083L3084: const sandboxExecution = spawn('npx', [
L3085: 'tsx',
...
L3089: anthropicKey,
L3090: 'http://localhost:8787', // Local dev server URL
L3091: targetDir // Project root directory for file output
...
L3096: env: {
L3097: ...process.env,
L3098: ANTHROPIC_API_KEY: anthropicKey
Findings
8 High5 Medium5 Low
HighChild Processcli-tool/components/sandbox/docker/execute.js
HighShellcli-tool/src/index.js
HighSame File Env Network Executioncli-tool/src/index.js
HighCredential Redirect Persistencecli-tool/src/index.js
HighExternal Ai Agent Control Surface Mutationcli-tool/components/sandbox/cloudflare/launcher.ts
HighTrigger Reachable External Ai Agent Control Surface Mutationcli-tool/src/index.js
HighSemantic Analysis Limitedcli-tool/src/install-ui.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltacli-tool/src/claude-api-proxy.js
MediumDynamic Requirecli-tool/bin/create-claude-config.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to claude-code-templates@1.30.0.
See all versions of claude-code-templates for other recorded verdicts.
- Review the evidence and your use of claude-code-templates@1.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.