registry / create-cartwright / 2.5.3

create-cartwright@2.5.3

Scaffold the build engine AIs reach for — a real site with design, database and backend, live in minutes. Websites, webshops and agent storefronts; MIT, you own the code.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The explicit scaffold CLI can install a pinned third-party skill into a global AI-agent skill location. This broadens the local agent control surface beyond the generated project.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run the CLI and accept the Modern Web Guidance prompt, or run with `--yes` without `--skip-skills`.

Impact

A third-party skill becomes discoverable by local AI coding agents; this package does not itself contain confirmed exfiltration or destructive behavior.

Mechanism

Executes a pinned `npx` AI-agent skill installer with automatic approval.

Rationale

Source inspection confirms a user-invoked, prompt-guarded global AI-agent extension installation, with automatic acceptance under `--yes`. This warrants a warning for agent-extension lifecycle risk, not a block: no npm lifecycle execution, credential theft, exfiltration, stealth persistence, or destructive chain is established in the inspected package.

Evidence

package.jsondist/index.jsdist/skills.jsdist/skills.test.jsdist/llm.js~/.agents/skills/

Network endpoints2

cartwright.app/api/telemetry/scaffoldgenerativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/skills.js` runs `npx --yes modern-web-guidance@0.0.174 install --yes`.
The installer states it writes a globally visible AI-agent skill under `~/.agents/skills/`.
`dist/index.js` invokes this installer after scaffolding; `--yes` suppresses the confirmation.
`dist/skills.test.js` explicitly verifies `--yes` installs unconditionally.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
The control-surface mutation occurs only after explicit CLI invocation, not package installation.
Interactive runs present a dedicated confirmation and `--skip-skills` disables it.
Other subprocesses are project-scoped scaffolding, dependency installation, git setup, or user-confirmed GitHub publishing.
Gemini requests use a user-supplied API key for the optional AI-generation feature; telemetry is disclosed and opt-out.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 251 KB of source, external domains: cartwright.app, cdn.example.com, desktop.github.com, example.com, generativelanguage.googleapis.com, github.com, images.unsplash.com, teloz.net

Source & flagged code

3 flagged

dist/look.jsView file

Lines 13-53javascript

13 *

14 * 1. skin → `designSlug: "<skin>"` in the scaffold's brand.config.ts

15 * (config beats DB in the engine's getActiveDesign resolution,

16 * so this is the trusted, committable way to pick the design).

17 * Skipped with a hint when the scaffold doesn't ship the design

18 * (e.g. pruned by the light profile).

19 * 2. palette / scene / chrome → the seeded database's BrandingSettings row

20 * (themeJson / threeDConfigJson.scene / chromeJson), written

21 * with the scaffold's own @libsql/client via a temp script —

22 * the exact field formats the engine's applyComposition writes.

23 *

24 * FAIL-SOFT EVERYWHERE: an unreachable URL, non-JSON response, wrong schema

25 * id, unknown skin or DB write failure prints one clear warning and the

26 * scaffold continues unchanged. A broken look must never break a scaffold.

27 *

28 * SHARING BOUNDARY: the public look never carries voice (genome copy) or

29 * homepageLayout — and this module ignores those fields if a full composition

30 * export is passed, applying only the cosmetic subset.

31 */

32import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";

33import { join } from "node:path";

34import { execSync } from "node:child_process";

35import { patchBrandConfigDesignSlug } from "./scaffold.js";

High

Child Process

Package source references child process execution.

dist/look.jsView on unpkg · L33

36export const LOOK_SCHEMA_ID = "cartwright-composition-v1";

37/** Fetch timeout — a slow look server must not hang the scaffold. */

38export const LOOK_FETCH_TIMEOUT_MS = 10_000;

39/** Cap on the response body — a look is a small JSON file, not a download. */

40export const LOOK_MAX_BYTES = 1_000_000;

41export const LOOK_PALETTE_KEYS = [

42 "accent",

43 "accentDeep",

44 "cream",

45 "sand",

46 "ink",

47 "muted",

48];

49/** #rgb / #rrggbb — mirror of the engine spec's HEX_RE. */

50const HEX_RE = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;

51/** kebab-case registry keys (design slugs, scene ids, chrome keys). */

52const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;

53function isRecord(v) {

dist/index.jsView file

Lines 44-84javascript

44 * --template sunglasses → webshop mode, legacy eyewear fields

45 * --template agent-marketplace → A2A mode, no shop GUI, A-JWT endpoints on

46 *

47 * Pulls a sanitised snapshot of cartwright-template via giget, generates a

48 * fresh AUTH_SECRET, injects the project name into brand.config.ts, and

49 * optionally installs deps + inits git.

50 */

51import { intro, outro, text, select, confirm, cancel, isCancel, spinner, note, password, } from "@clack/prompts";

52import { downloadTemplate } from "giget";

53import pc from "picocolors";

54import { existsSync, readFileSync, writeFileSync } from "node:fs";

55import { join, resolve } from "node:path";

56import { execSync, spawnSync } from "node:child_process";

57import { parseArgs } from "node:util";

58import { fileURLToPath } from "node:url";

59// Read the real version from package.json so the banner never drifts.

60const CLI_VERSION = JSON.parse(readFileSync(join(fileURLToPath(new URL(".", import.meta.url)), "../package.json"), "utf8")).version;

61const TEMPLATE_REPO = "github:Teloz1870/cartwright-template";

62/** True if a CLI tool is on PATH (used to offer optional gh-based publishing). */

63function commandExists(cmd) {

64 try {

65 execSync(`${cmd} --version`, { stdio: "ignore" });

66 return true;

67 }

68 catch {

69 return false;

70 }

71}

72// Default channel resolves to the latest tag mirrored from cartwright-private.

73// Bump together with a Changeset whenever a new template tag goes out —

74// .github/workflows/bump-template-ref.yml does this automatically by opening

75// a PR when it sees a newer tag on the public mirror.

76const DEFAULT_REF = "v0.39.1";

77// Channel aliases the user can pass via --ref.

78// stable → DEFAULT_REF (latest tag — what default `npx create-cartwright` uses)

79// next → bleeding-edge branch on the mirror, updated on every push to

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L64

80// cartwright-private/main. Not recommended for production scaffolds.

81const REF_ALIASES = {

82 stable: DEFAULT_REF,

83 next: "next",

84};

•matchType = previous_version_dangerous_delta matchedPackage = create-cartwright@2.5.1 matchedIdentity = npm:Y3JlYXRlLWNhcnR3cmlnaHQ:2.5.1 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/look.jsView file

33import { join } from "node:path"; L34: import { execSync } from "node:child_process"; L35: import { patchBrandConfigDesignSlug } from "./scaffold.js";

High

Child Process

Package source references child process execution.

dist/look.jsView on unpkg · L33

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

64try { L65: execSync(`${cmd} --version`, { stdio: "ignore" }); L66: return true; ... L77: // Channel aliases the user can pass via --ref. L78: // stable → DEFAULT_REF (latest tag — what default `npx create-cartwright` uses) L79: // next → bleeding-edge branch on the mirror, updated on every push to

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L64

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/look.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/look.jsView file

Lines 13-53javascript

13 *

14 * 1. skin → `designSlug: "<skin>"` in the scaffold's brand.config.ts

15 * (config beats DB in the engine's getActiveDesign resolution,

16 * so this is the trusted, committable way to pick the design).

17 * Skipped with a hint when the scaffold doesn't ship the design

18 * (e.g. pruned by the light profile).

19 * 2. palette / scene / chrome → the seeded database's BrandingSettings row

20 * (themeJson / threeDConfigJson.scene / chromeJson), written

21 * with the scaffold's own @libsql/client via a temp script —

22 * the exact field formats the engine's applyComposition writes.

23 *

24 * FAIL-SOFT EVERYWHERE: an unreachable URL, non-JSON response, wrong schema

25 * id, unknown skin or DB write failure prints one clear warning and the

26 * scaffold continues unchanged. A broken look must never break a scaffold.

27 *

28 * SHARING BOUNDARY: the public look never carries voice (genome copy) or

29 * homepageLayout — and this module ignores those fields if a full composition

30 * export is passed, applying only the cosmetic subset.

31 */

32import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";

33import { join } from "node:path";

34import { execSync } from "node:child_process";

35import { patchBrandConfigDesignSlug } from "./scaffold.js";

High

Child Process

Package source references child process execution.

dist/look.jsView on unpkg · L33

36export const LOOK_SCHEMA_ID = "cartwright-composition-v1";

37/** Fetch timeout — a slow look server must not hang the scaffold. */

38export const LOOK_FETCH_TIMEOUT_MS = 10_000;

39/** Cap on the response body — a look is a small JSON file, not a download. */

40export const LOOK_MAX_BYTES = 1_000_000;

41export const LOOK_PALETTE_KEYS = [

42 "accent",

43 "accentDeep",

44 "cream",

45 "sand",

46 "ink",

47 "muted",

48];

49/** #rgb / #rrggbb — mirror of the engine spec's HEX_RE. */

50const HEX_RE = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;

51/** kebab-case registry keys (design slugs, scene ids, chrome keys). */

52const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;

53function isRecord(v) {

dist/index.jsView file

Lines 44-84javascript

44 * --template sunglasses → webshop mode, legacy eyewear fields

45 * --template agent-marketplace → A2A mode, no shop GUI, A-JWT endpoints on

46 *

47 * Pulls a sanitised snapshot of cartwright-template via giget, generates a

48 * fresh AUTH_SECRET, injects the project name into brand.config.ts, and

49 * optionally installs deps + inits git.

50 */

51import { intro, outro, text, select, confirm, cancel, isCancel, spinner, note, password, } from "@clack/prompts";

52import { downloadTemplate } from "giget";

53import pc from "picocolors";

54import { existsSync, readFileSync, writeFileSync } from "node:fs";

55import { join, resolve } from "node:path";

56import { execSync, spawnSync } from "node:child_process";

57import { parseArgs } from "node:util";

58import { fileURLToPath } from "node:url";

59// Read the real version from package.json so the banner never drifts.

60const CLI_VERSION = JSON.parse(readFileSync(join(fileURLToPath(new URL(".", import.meta.url)), "../package.json"), "utf8")).version;

61const TEMPLATE_REPO = "github:Teloz1870/cartwright-template";

62/** True if a CLI tool is on PATH (used to offer optional gh-based publishing). */

63function commandExists(cmd) {

64 try {

65 execSync(`${cmd} --version`, { stdio: "ignore" });

66 return true;

67 }

68 catch {

69 return false;

70 }

71}

72// Default channel resolves to the latest tag mirrored from cartwright-private.

73// Bump together with a Changeset whenever a new template tag goes out —

74// .github/workflows/bump-template-ref.yml does this automatically by opening

75// a PR when it sees a newer tag on the public mirror.

76const DEFAULT_REF = "v0.39.1";

77// Channel aliases the user can pass via --ref.

78// stable → DEFAULT_REF (latest tag — what default `npx create-cartwright` uses)

79// next → bleeding-edge branch on the mirror, updated on every push to

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L64

80// cartwright-private/main. Not recommended for production scaffolds.

81const REF_ALIASES = {

82 stable: DEFAULT_REF,

83 next: "next",

84};

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg