registry / create-cartwright / 2.4.2

create-cartwright@2.4.2

Scaffold the build engine AIs reach for — a real site with design, database and backend, live in minutes. Websites, webshops and agent storefronts; MIT, you own the code.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 216 KB of source, external domains: cartwright.app, cdn.example.com, desktop.github.com, example.com, generativelanguage.googleapis.com, github.com, images.unsplash.com, teloz.net

Source & flagged code

2 flagged

dist/skills.jsView file

Lines 1-37javascript

1/**

2 * AI-agent skills installer.

3 *

4 * After the template snapshot is downloaded and dependencies installed, the

5 * CLI optionally runs Chrome team's `modern-web-guidance` skill installer in

6 * the customer's project directory. That places the skill in their machine's

7 * agent-skills location (typically `~/.agents/skills/`) so Claude Code,

8 * Cursor, and Copilot all see it on first session.

9 *

10 * The Cartwright-specific skill scaffolding (`.claude/skills/cartwright-guidance/`,

11 * `.cursor/rules/`, `.github/copilot-instructions.md`) is part of the template

12 * itself and ships unconditionally — this module only handles the upstream

13 * Chrome-team install.

14 *

15 * Best-effort throughout: declines, timeouts, and errors degrade gracefully

16 * to a printed note. The scaffold itself never fails because of this step.

17 */

18import { execSync } from "node:child_process";

19import { confirm, isCancel, note, spinner } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/skills.jsView on unpkg · L17

20import pc from "picocolors";

21/**

22 * Pinned version of the upstream skill. modern-web-guidance is pre-1.0

23 * (last surveyed: 2026-05-26), so an unpinned `@latest` would risk silent

24 * API drift between scaffolds. A scheduled workflow in

25 * `.github/workflows/bump-modern-web-guidance.yml` opens a PR when a newer

26 * version appears upstream; merge gates on manual review of the changelog.

27 *

28 * Once upstream hits 1.0, switch this to a semver range like "^1.0.0" and

29 * retire the bump workflow.

30 */

31export const MODERN_WEB_GUIDANCE_VERSION = "0.0.170";

32/**

33 * Generous upper bound. modern-web-guidance is ~36 MB; on a typical

34 * connection the install finishes in 10–20s. 30s gives slow networks room

35 * without making the customer wait forever on a hung registry call.

36 */

37export const SKILL_INSTALL_TIMEOUT_MS = 30_000;

dist/index.jsView file

Lines 37-77javascript

37 * --template sunglasses → webshop mode, legacy eyewear fields

38 * --template agent-marketplace → A2A mode, no shop GUI, A-JWT endpoints on

39 *

40 * Pulls a sanitised snapshot of cartwright-template via giget, generates a

41 *

Source & flagged code

2 flagged · loading source

dist/skills.jsView file

17*/ L18: import { execSync } from "node:child_process"; L19: import { confirm, isCancel, note, spinner } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/skills.jsView on unpkg · L17

dist/index.jsView file

57try { L58: execSync(`${cmd} --version`, { stdio: "ignore" }); L59: return true; ... L70: // Channel aliases the user can pass via --ref. L71: // stable → DEFAULT_REF (latest tag — what default `npx create-cartwright` uses) L72: // next → bleeding-edge branch on the mirror, updated on every push to

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L57

Findings

3 High3 Medium4 Low

HighChild Processdist/skills.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/skills.jsView file

Lines 1-37javascript

1/**

2 * AI-agent skills installer.

3 *

4 * After the template snapshot is downloaded and dependencies installed, the

5 * CLI optionally runs Chrome team's `modern-web-guidance` skill installer in

6 * the customer's project directory. That places the skill in their machine's

7 * agent-skills location (typically `~/.agents/skills/`) so Claude Code,

8 * Cursor, and Copilot all see it on first session.

9 *

10 * The Cartwright-specific skill scaffolding (`.claude/skills/cartwright-guidance/`,

11 * `.cursor/rules/`, `.github/copilot-instructions.md`) is part of the template

12 * itself and ships unconditionally — this module only handles the upstream

13 * Chrome-team install.

14 *

15 * Best-effort throughout: declines, timeouts, and errors degrade gracefully

16 * to a printed note. The scaffold itself never fails because of this step.

17 */

18import { execSync } from "node:child_process";

19import { confirm, isCancel, note, spinner } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/skills.jsView on unpkg · L17

20import pc from "picocolors";

21/**

22 * Pinned version of the upstream skill. modern-web-guidance is pre-1.0

23 * (last surveyed: 2026-05-26), so an unpinned `@latest` would risk silent

24 * API drift between scaffolds. A scheduled workflow in

25 * `.github/workflows/bump-modern-web-guidance.yml` opens a PR when a newer

26 * version appears upstream; merge gates on manual review of the changelog.

27 *

28 * Once upstream hits 1.0, switch this to a semver range like "^1.0.0" and

29 * retire the bump workflow.

30 */

31export const MODERN_WEB_GUIDANCE_VERSION = "0.0.170";

32/**

33 * Generous upper bound. modern-web-guidance is ~36 MB; on a typical

34 * connection the install finishes in 10–20s. 30s gives slow networks room

35 * without making the customer wait forever on a hung registry call.

36 */

37export const SKILL_INSTALL_TIMEOUT_MS = 30_000;

dist/index.jsView file

Lines 37-77javascript

37 * --template sunglasses → webshop mode, legacy eyewear fields

38 * --template agent-marketplace → A2A mode, no shop GUI, A-JWT endpoints on

39 *

40 * Pulls a sanitised snapshot of cartwright-template via giget, generates a

41 *