registry / create-claritty-app / 0.7.0

create-claritty-app@0.7.0

Scaffold, test, and deploy Claritty agentic apps. Includes the `claritty` CLI (login/test/deploy).

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 102 KB of source, external domains: api.claritty.ai, app.claritty.ai, github.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 50-90javascript

50exports.cmdLogin = cmdLogin;

51exports.cmdWhoami = cmdWhoami;

52exports.cmdLogout = cmdLogout;

53exports.cmdKeys = cmdKeys;

54exports.cmdDeploy = cmdDeploy;

55exports.cmdPublish = cmdPublish;

56exports.cmdStatus = cmdStatus;

57exports.cmdTest = cmdTest;

58exports.cmdDiscover = cmdDiscover;

59/**

60 * create-claritty-app

61 *

62 * One-command scaffolder for Claritty agentic apps. Clones the public

63 * `agentic-app-seed` template (degit-style — fresh git history), copies the

64 * env file, and prints next steps. Zero runtime dependencies so `npx` stays

65 * fast and works in any environment (Claude Code, Codex, Cursor, plain shell).

66 *

67 * The seed already ships its own .claude/ config + CLAUDE.md + .cursorrules, so

68 * once the user is inside the scaffolded directory the coding agent is guided.

69 * This tool only removes the manual clone-and-configure friction at the start.

70 */

71const node_child_process_1 = require("node:child_process");

72const fs = __importStar(require("node:fs"));

73const path = __importStar(require("node:path"));

74const readline = __importStar(require("node:readline"));

75const cred = __importStar(require("./credentials"));

76// --- Constants ---------------------------------------------------------------

77/** Public seed repository. Cloned credential-free over HTTPS. */

78const DEFAULT_SEED_REPO = 'https://github.com/Clarittyai/agentic-app-seed.git';

79/**

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L70

80 * Pinned seed ref for reproducible scaffolds. When this tag is missing on the

81 * remote we fall back to `main` (see cloneSeed). Bump this when a new seed

82 * release is cut.

83 */

84const DEFAULT_SEED_REF = 'v1.7.0';

85const FALLBACK_SEED_REF = 'main';

86// The API host (not the web app at app.claritty.ai) — the CLI talks to the API

87// directly. Override with --platform-url or CLARITTY_PLATFORM_URL.

88const PLATFORM_URL_DEFAULT = 'https://api.claritty.ai';

89// Every CLI request MUST send a User-Agent — the platform's CDN/WAF returns 403

90// (GET) / resets the connection (POST/PUT) for requests without one, or with a

•matchType = previous_version_dangerous_delta matchedPackage = create-claritty-app@0.6.6 matchedIdentity = npm:Y3JlYXRlLWNsYXJpdHR5LWFwcA:0.6.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.jsView file

70*/ L71: const node_child_process_1 = require("node:child_process"); L72: const fs = __importStar(require("node:fs")); ... L77: /** Public seed repository. Cloned credential-free over HTTPS. */ L78: const DEFAULT_SEED_REPO = 'https://github.com/Clarittyai/agentic-app-seed.git'; L79: /** ... L118: // --- Tiny ANSI helpers (no deps) --------------------------------------------- L119: const supportsColor = process.stdout.isTTY && process.env.NO_COLOR === undefined; L120: const paint = (code, s) => (supportsColor ? `\x1b[${code}m${s}\x1b[0m` : s); ... L167: const SPIN_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏']; L168: const spinTTY = !!process.stdout.isTTY && process.env.NO_COLOR === undefined && process.env.CI === undefined; L169: let activeSpinner = null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L70

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 50-90javascript

50exports.cmdLogin = cmdLogin;

51exports.cmdWhoami = cmdWhoami;

52exports.cmdLogout = cmdLogout;

53exports.cmdKeys = cmdKeys;

54exports.cmdDeploy = cmdDeploy;

55exports.cmdPublish = cmdPublish;

56exports.cmdStatus = cmdStatus;

57exports.cmdTest = cmdTest;

58exports.cmdDiscover = cmdDiscover;

59/**

60 * create-claritty-app

61 *

62 * One-command scaffolder for Claritty agentic apps. Clones the public

63 * `agentic-app-seed` template (degit-style — fresh git history), copies the

64 * env file, and prints next steps. Zero runtime dependencies so `npx` stays

65 * fast and works in any environment (Claude Code, Codex, Cursor, plain shell).

66 *

67 * The seed already ships its own .claude/ config + CLAUDE.md + .cursorrules, so

68 * once the user is inside the scaffolded directory the coding agent is guided.

69 * This tool only removes the manual clone-and-configure friction at the start.

70 */

71const node_child_process_1 = require("node:child_process");

72const fs = __importStar(require("node:fs"));

73const path = __importStar(require("node:path"));

74const readline = __importStar(require("node:readline"));

75const cred = __importStar(require("./credentials"));

76// --- Constants ---------------------------------------------------------------

77/** Public seed repository. Cloned credential-free over HTTPS. */

78const DEFAULT_SEED_REPO = 'https://github.com/Clarittyai/agentic-app-seed.git';

79/**

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L70

80 * Pinned seed ref for reproducible scaffolds. When this tag is missing on the

81 * remote we fall back to `main` (see cloneSeed). Bump this when a new seed

82 * release is cut.

83 */

84const DEFAULT_SEED_REF = 'v1.7.0';

85const FALLBACK_SEED_REF = 'main';

86// The API host (not the web app at app.claritty.ai) — the CLI talks to the API

87// directly. Override with --platform-url or CLARITTY_PLATFORM_URL.

88const PLATFORM_URL_DEFAULT = 'https://api.claritty.ai';

89// Every CLI request MUST send a User-Agent — the platform's CDN/WAF returns 403

90// (GET) / resets the connection (POST/PUT) for requests without one, or with a

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg