claude-code-templates@1.31.0
Component templates and tracking system for Claude Code
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package sends runtime usage telemetry by default, with opt-out environment flags but no clear user-facing disclosure found. The inspected data does not show credential or file-content collection, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI commands that invoke tracking, including component installation.
Impact
Usage details and potentially identifying local path information are sent without a clear user-facing disclosure.
Mechanism
The CLI posts usage events to its own service; component-install events can include a target directory path relative to the current working directory. Environment flags can disable tracking.
AI rationale
The package sends runtime usage telemetry by default, with opt-out environment flags but no clear user-facing disclosure found. The inspected data does not show credential or file-content collection, so this warrants a warning rather than a block.
Evidence
cli-tool/src/tracking-service.jscli-tool/src/index.js
Network endpoints3
www.aitmpl.com/api/track-download-supabasewww.aitmpl.com/api/track-command-usagewww.aitmpl.com/api/track-installation-outcome
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime usage tracking is enabled by default unless tracking is disabled through environment flags.
- Component tracking includes the event and selected component details, and its payload can include a target directory path.
- The tracking service sends component events to www.aitmpl.com.
- Component installation triggers tracking and supplies the target directory relative to the current working directory.
Evidence against
- The manifest declares only a prepublishOnly lifecycle script, not an install-time hook.
- Error reporting is separately gated by an explicit CCT_ERROR_REPORTING=true opt-in.
- The inspected tracking fields do not include credentials or file contents.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
4 flaggedcli-tool/bin/create-claude-config.jsView file
2L3: const { program, Option } = require('commander');
L4: const chalk = require('chalk');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
cli-tool/bin/create-claude-config.jsView on unpkg · L2cli-tool/src/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
throw new error(`http ${response.status}: ${response.statustext} (${relativepath || '/'})`);
}
const contents = await response.json();
for (const item of contents) {
const itempath = relativepath ? `${relativepath}/${item.name}` : item.name;
if (item.name.includes('..') || (item.name.startswith('.') && item.name !== '.claude-plugin')) continue;
if (item.type === 'file') {
const fileresponse = await fetch(item.download_url);
if (!fileresponse.ok) throw new error(`could not download ${itempath} (http ${fileresponse.status})
High
Trigger Reachable External Ai Agent Control Surface Mutation
Findings
3 High4 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli-tool/src/index.js
HighSemantic Analysis Limitedcli-tool/src/install-ui.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltacli-tool/src/health-check.js
MediumDynamic Requirecli-tool/bin/create-claude-config.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to claude-code-templates@1.31.0.
See all versions of claude-code-templates for other recorded verdicts.
- Review the evidence and your use of claude-code-templates@1.31.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.