claude-code-templates@1.32.0
Component templates and tracking system for Claude Code
AI Security Review
scanned 1d ago · by lpm-firewall-aiThis is suspicious runtime telemetry: component installs send a project-relative local path to the package’s own service by default, and the README does not disclose the collection. Opt-out flags exist, and the source shows no credential theft or other concrete attack behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A component installation succeeds through the CLI while tracking is enabled.
Impact
The service receives a local project path that may reveal identifying directory names. The package source provides opt-out flags, but this collection is not disclosed in the README.
Mechanism
The installer adds target_directory, computed relative to the current working directory, to tracking metadata; tracking-service.js sends the resulting path field in a POST request.
AI rationale
This is suspicious runtime telemetry: component installs send a project-relative local path to the package’s own service by default, and the README does not disclose the collection. Opt-out flags exist, and the source shows no credential theft or other concrete attack behavior.
Evidence
cli-tool/src/index.jscli-tool/src/tracking-service.js
Network endpoints1
www.aitmpl.com/api/track-download-supabase
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Tracking is enabled by default unless an opt-out flag or CI is set.
- Successful component installs include the target directory relative to the current working directory in tracking metadata; the service sends that metadata to www.aitmpl.com.
- The tracking payload includes a path field populated from that target-directory metadata.
Evidence against
- Users can disable tracking with CCT_NO_TRACKING=true, CCT_NO_ANALYTICS=true, or CI=true.
- The path-bearing tracking call occurs after a component installation succeeds in the CLI flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggedcli-tool/bin/create-claude-config.jsView file
2L3: const { program, Option } = require('commander');
L4: const chalk = require('chalk');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
cli-tool/bin/create-claude-config.jsView on unpkg · L2cli-tool/src/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
throw new error(`http ${response.status}: ${response.statustext} (${relativepath || '/'})`);
}
const contents = await response.json();
for (const item of contents) {
const itempath = relativepath ? `${relativepath}/${item.name}` : item.name;
if (item.name.includes('..') || (item.name.startswith('.') && item.name !== '.claude-plugin')) continue;
if (item.type === 'file') {
const fileresponse = await fetch(item.download_url);
if (!fileresponse.ok) throw new error(`could not download ${itempath} (http ${fileresponse.status})
High
Trigger Reachable External Ai Agent Control Surface Mutation
Findings
3 High4 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli-tool/src/index.js
HighSemantic Analysis Limitedcli-tool/src/install-ui.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltacli-tool/src/tracking-service.js
MediumDynamic Requirecli-tool/bin/create-claude-config.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to claude-code-templates@1.32.0.
See all versions of claude-code-templates for other recorded verdicts.
- Review the evidence and your use of claude-code-templates@1.32.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.