registry / create-raredays-app / 0.3.0

create-raredays-app@0.3.0

Scaffold a new RareDays Next.js app.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The user-invoked scaffolder copies bundled agent settings into the selected project and initializes a local skillex registry after an optional install. It can also add a project-local MCP server configuration when --harness is selected. No unconsented install-time or foreign control-surface mutation is established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit execution of create-raredays-app; optional install and --harness selection.

Impact

Generated projects may grant broad local agent capabilities and register an MCP command.

Mechanism

Project-local AI-agent settings, skill registry, and optional MCP scaffolding.

Rationale

Source inspection found no malicious lifecycle hook, credential exfiltration, remote code loading, destructive action, or stealth persistence. Policy calls for warning on first-party, user-invoked agent-extension setup with broad generated permissions.

Evidence

package.jsonbin/index.jstemplates/client/_claude/settings.jsontemplates/full-stack/_claude/settings.jsontemplates/static/_claude/settings.json<targetDir>/.claude/settings.json

Decision evidence

public snapshot

AI called this at 93.0% confidence with false-positive risk.

create-raredays-app@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code