registry / create-rigel / 0.5.0

create-rigel@0.5.0

Scaffold an agent-first, gate-enforced starter project — Next.js, Express+TypeScript, NestJS, or FastAPI — wired for Claude Code.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 98.2 KB of source

Source & flagged code

7 flagged

templates/nextjs/.claude/scripts/infra-setup.shView file

Lines 830-870shell

830

831 const violations = checkStyles(

832 collected.map((c) => ({ route, sel: c.sel, styles: c.styles })),

833 tokens,

834 )

835 expect(

836 violations,

837 `Non-token values on ${route} (add them to DESIGN.md tokens or fix the styles):\n${violations.join('\n')}`,

838 ).toEqual([])

839 })

840 }

841})

842EOF

843

844write_if_absent tests/e2e/helpers/auth.ts <<'EOF'

845import { type Page, expect } from '@playwright/test'

846

847// Logs a user in through the real login form and waits for the post-login redirect.

848// Adjust selectors / destination to match your app's auth flow. Used by the

849// REQUIRED cross-user isolation test (tests/e2e/isolation.spec.ts).

850export async function loginAs(page: Page, email: string, password = 'password123') {

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/nextjs/.claude/scripts/infra-setup.shView on unpkg · L850

851 await page.goto('/login')

852 await page.getByLabel('Email').fill(email)

853 await page.getByLabel('Password').fill(password)

854 await page.getByRole('button', { name: /sign in/i }).click()

855 await expect(page).not.toHaveURL(/\/login$/)

856}

857EOF

858

859write_if_absent tests/e2e/isolation.spec.ts <<'EOF'

860import { test, expect } from '@playwright/test'

861import { loginAs } from './helpers/auth'

862

863// The single most important security test: confirm User B cannot reach User A's

864// resource, and that the app reveals 404 (not 403 — a 403 leaks that it exists).

865// Add one of these per user-owned resource type. The backend enforces isolation via

866// `userId in WHERE`; this proves the frontend surfaces it correctly.

867//

868// SKIPPED BY DEFAULT: a fresh scaffold has no /login flow or backend, so this would

869// fail CI on day one. Change `test.skip` → `test` (and wire helpers/auth.ts) the moment

870// you ship your first user-owned resource. The PR template makes that a DoD item.

templates/express/scripts/lib/rigel-evals.mjsView file

Lines 1-32javascript

1// scripts/lib/rigel-evals.mjs

2// Shared helpers for the deterministic-eval scripts (redgreen-record, ac-vector).

3// Pure Node (no deps) so it runs anywhere the template is scaffolded.

4//

5// The linkage this file resolves:

6// docs/exec-plans/active/PLAN-XXX.md (the active plan)

7// → **Spec:** docs/product-specs/ready/SPEC-XXX.md (the linked spec)

8// → ## Acceptance Criteria → AC-1, AC-2, … (the AC-IDs)

9// → tests/acceptance/SPEC-XXX/*.test.ts (title contains the AC-ID)

templates/express/scripts/openapi.export.tsView file

Lines 21-61typescript

21import { dirname, resolve } from 'node:path'

22import { fileURLToPath, pathToFileURL } from 'node:url'

23import { OpenApiGeneratorV31, OpenAPIRegistry } from '@asteasolutions/zod-to-openapi'

24import { stringify as yamlStringify } from 'yaml'

templates/express/MakefileView file

•path = templates/express/Makefile kind = build_helper sizeBytes = 2138 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/express/MakefileView on unpkg

templates/express/.claude/hooks/post-write.shView file

•path = templates/express/.claude/hooks/post-write.sh kind = payload_in_excluded_dir sizeBytes = 4667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/express/.claude/hooks/post-write.shView on unpkg

templates/nestjs/.claude/rules/testing.mdView file

Lines 81-121markdown

81import * as request from 'supertest'

82import { AppModule } from '../src/app.module'

83import { INestApplication, ValidationPipe } from '@nestjs/common'

85describe('ApplicationController (e2e)', () => {

86 let app: INestApplication

87 let token: string

89 beforeAll(async () => {

90 const module = await Test.createTestingModule({

91 imports: [AppModule

Source & flagged code

7 flagged · loading source

templates/nextjs/.claude/scripts/infra-setup.shView file

850

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code