registry / create-claritty-app / 0.6.5

create-claritty-app@0.6.5

Scaffold, test, and deploy Claritty agentic apps. Includes the `claritty` CLI (login/test/deploy).

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 100 KB of source, external domains: api.claritty.ai, app.claritty.ai, github.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 50-90javascript

50exports.cmdLogin = cmdLogin;

51exports.cmdWhoami = cmdWhoami;

52exports.cmdLogout = cmdLogout;

53exports.cmdKeys = cmdKeys;

54exports.cmdDeploy = cmdDeploy;

55exports.cmdPublish = cmdPublish;

56exports.cmdStatus = cmdStatus;

57exports.cmdTest = cmdTest;

58exports.cmdDiscover = cmdDiscover;

59/**

60 * create-claritty-app

61 *

62 * One-command scaffolder for Claritty agentic apps. Clones the public

63 * `agentic-app-seed` template (degit-style — fresh git history), copies the

64 * env file, and prints next steps. Zero runtime dependencies so `npx` stays

65 * fast and works in any environment (Claude Code, Codex, Cursor, plain shell).

66 *

67 * The seed already ships its own .claude/ config + CLAUDE.md + .cursorrules, so

68 * once the user is inside the scaffolded directory the coding agent is guided.

69 * This tool only removes the manual clone-and-configure friction at the start.

70 */

71const node_child_process_1 = require("node:child_process");

72const fs = __importStar(require("node:fs"));

73const path = __importStar(require("node:path"));

74const readline = __importStar(require("node:readline"));

75const cred = __importStar(require("./credentials"));

76// --- Constants ---------------------------------------------------------------

77/** Public seed repository. Cloned credential-free over HTTPS. */

78const DEFAULT_SEED_REPO = 'https://github.com/Clarittyai/agentic-app-seed.git';

79/**

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L70

80 * Pinned seed ref for reproducible scaffolds. When this tag is missing on the

81 * remote we fall back to `main` (see cloneSeed). Bump this when a new seed

82 * release is cut.

83 */

84const DEFAULT_SEED_REF = 'v1.6.1';

85const FALLBACK_SEED_REF = 'main';

86// The API host (not the web app at app.claritty.ai) — the CLI talks to the API

87// directly. Override with --platform-url or CLARITTY_PLATFORM_URL.

88const PLATFORM_URL_DEFAULT = 'https://api.claritty.ai';

89// The web workspace where users actually open a deployed app. The raw

90// `<appId>.apps.claritty.ai` host is edge-auth-gated and can't be opened

Source & flagged code

1 flagged · loading source

dist/index.jsView file

70*/ L71: const node_child_process_1 = require("node:child_process"); L72: const fs = __importStar(require("node:fs")); ... L77: /** Public seed repository. Cloned credential-free over HTTPS. */ L78: const DEFAULT_SEED_REPO = 'https://github.com/Clarittyai/agentic-app-seed.git'; L79: /** ... L110: // --- Tiny ANSI helpers (no deps) --------------------------------------------- L111: const supportsColor = process.stdout.isTTY && process.env.NO_COLOR === undefined; L112: const paint = (code, s) => (supportsColor ? `\x1b[${code}m${s}\x1b[0m` : s); ... L159: const SPIN_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏']; L160: const spinTTY = !!process.stdout.isTTY && process.env.NO_COLOR === undefined && process.env.CI === undefined; L161: let activeSpinner = null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L70

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 50-90javascript

50exports.cmdLogin = cmdLogin;

51exports.cmdWhoami = cmdWhoami;

52exports.cmdLogout = cmdLogout;

53exports.cmdKeys = cmdKeys;

54exports.cmdDeploy = cmdDeploy;

55exports.cmdPublish = cmdPublish;

56exports.cmdStatus = cmdStatus;

57exports.cmdTest = cmdTest;

58exports.cmdDiscover = cmdDiscover;

59/**

60 * create-claritty-app

61 *

62 * One-command scaffolder for Claritty agentic apps. Clones the public

63 * `agentic-app-seed` template (degit-style — fresh git history), copies the

64 * env file, and prints next steps. Zero runtime dependencies so `npx` stays

65 * fast and works in any environment (Claude Code, Codex, Cursor, plain shell).

66 *

67 * The seed already ships its own .claude/ config + CLAUDE.md + .cursorrules, so

68 * once the user is inside the scaffolded directory the coding agent is guided.

69 * This tool only removes the manual clone-and-configure friction at the start.

70 */

71const node_child_process_1 = require("node:child_process");

72const fs = __importStar(require("node:fs"));

73const path = __importStar(require("node:path"));

74const readline = __importStar(require("node:readline"));

75const cred = __importStar(require("./credentials"));

76// --- Constants ---------------------------------------------------------------

77/** Public seed repository. Cloned credential-free over HTTPS. */

78const DEFAULT_SEED_REPO = 'https://github.com/Clarittyai/agentic-app-seed.git';

79/**

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L70

80 * Pinned seed ref for reproducible scaffolds. When this tag is missing on the

81 * remote we fall back to `main` (see cloneSeed). Bump this when a new seed

82 * release is cut.

83 */

84const DEFAULT_SEED_REF = 'v1.6.1';

85const FALLBACK_SEED_REF = 'main';

86// The API host (not the web app at app.claritty.ai) — the CLI talks to the API

87// directly. Override with --platform-url or CLARITTY_PLATFORM_URL.

88const PLATFORM_URL_DEFAULT = 'https://api.claritty.ai';

89// The web workspace where users actually open a deployed app. The raw

90// `<appId>.apps.claritty.ai` host is edge-auth-gated and can't be opened