create-prosell-app@0.2.0

No blocking static signals were detected.

User runs `npm run setup` in the generated project.

Copies API credentials into the generated project's `.env.local`, increasing local secret exposure if that project is later mishandled.

Explicit credential import from a package-owned MCP config into local environment configuration.

The package is not concretely malicious, but it intentionally imports credentials from a user-home MCP configuration into a generated project on an explicit command. This is a real capability that merits a warning under the firewall policy despite the absence of install-time execution or exfiltration.