registry / create-bestax / 3.1.0

create-bestax@3.1.0

Create a new bestax-bulma project

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The user-invoked scaffolding CLI can install first-party Bestax agent skills into a newly created project. No install-time execution or confirmed credential, network, or remote-code attack surface was found.

Static reason

No blocking static signals were detected.

Trigger

Running `create-bestax <project>` with `--skills`, or with `--yes` which defaults skills on.

Impact

Adds package-owned AI-agent instructions to the generated project; no foreign or broad agent-control mutation is observed.

Mechanism

Copies bundled templates to `.claude/skills` and writes `CLAUDE.md` in the target project.

Rationale

Source inspection confirms a package-owned AI-agent scaffold activated by the user-facing generator, including a `--yes` default. It is not malicious, but policy classifies this first-party agent extension lifecycle behavior as warn-worthy.

Evidence

package.jsondist/index.jsdist/cli.jsdist/project-creator.jsdist/file-system.jsdist/constants.jsdist/prompts.jstemplates/skills/bestax-custom-component/SKILL.mdtemplates/skills/bestax-form/SKILL.mdtemplates/skills/bestax-layout-scaffold/SKILL.mdtemplates/skills/bestax-theming/SKILL.md.claude/skillsCLAUDE.md

create-bestax@3.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code