registry / create-ai-boilerplate / 0.1.5

create-ai-boilerplate@0.1.5

Scaffold a new project from the Boilerplate: an operating system and guide for building software with AI, from idea to shipped product.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 46.0 KB of source, external domains: schema.org

Source & flagged code

3 flagged

template/skills/environment-and-secrets.skill.mdView file

Lines 34-74markdown

35- `NEXT_PUBLIC_*` is **inlined into the browser bundle at build time.** It is public. Anyone can read it in DevTools. Only non-secret config goes here (a publishable Stripe key, a PostHog project key, a public site URL).

36- Everything else is **server-only** and never reaches the client.

38- ✅ ALWAYS confirm a value is safe to be public before you give it a `NEXT_PUBLIC_` prefix.

39- ❌ NEVER prefix a secret with `NEXT_PUBLIC_`

Source & flagged code

3 flagged · loading source

template/skills/environment-and-secrets.skill.mdView file

54patternName = stripe_test_secret severity = high line = 54 matchedText = STRIPE_S...xxxx

High

High Secret

Package contains a high-severity secret pattern.

template/skills/environment-and-secrets.skill.mdView on unpkg · L54

54patternName = stripe_test_secret severity = high line = 54 matchedText = STRIPE_S...xxxx

High

Secret Pattern

Stripe test secret key in template/skills/environment-and-secrets.skill.md

template/skills/environment-and-secrets.skill.mdView on unpkg · L54

template/scripts/install-harness.shView file

•path = template/scripts/install-harness.sh kind = build_helper sizeBytes = 1718 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/install-harness.shView on unpkg

Findings

2 High3 Medium5 Low

HighHigh Secrettemplate/skills/environment-and-secrets.skill.md

HighSecret Patterntemplate/skills/environment-and-secrets.skill.md

MediumEnvironment Vars

MediumShips Build Helpertemplate/scripts/install-harness.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings