registry / create-rigel / 0.4.0

create-rigel@0.4.0

Scaffold an agent-first, gate-enforced starter project — Next.js, Express+TypeScript, NestJS, or FastAPI — wired for Claude Code.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 35.4 KB of source

Source & flagged code

5 flagged

templates/nextjs/.claude/scripts/infra-setup.shView file

Lines 264-304shell

264})

265

266describe('app pages contain no business logic', () => {

267 it('page.tsx files import features, not hooks directly', () => {

268 // Supports both app-router layouts (src/app with --src-dir, or top-level app/).

269 const pages = [...walk('src/app'), ...walk('app')].filter((f) => f.endsWith('page.tsx'))

270 const violations = pages.filter((f) =>

271 importsOf(f).some((imp) => imp.startsWith('@/hooks')),

272 )

273 expect(violations, violations.join('\n')).toHaveLength(0)

274 })

275})

276EOF

277

278write_if_absent tests/e2e/helpers/auth.ts <<'EOF'

279import { type Page, expect } from '@playwright/test'

280

281// Logs a user in through the real login form and waits for the post-login redirect.

282// Adjust selectors / destination to match your app's auth flow. Used by the

283// REQUIRED cross-user isolation test (tests/e2e/isolation.spec.ts).

284export async function loginAs(page: Page, email: string, password = 'password123') {

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/nextjs/.claude/scripts/infra-setup.shView on unpkg · L284

285 await page.goto('/login')

286 await page.getByLabel('Email').fill(email)

287 await page.getByLabel('Password').fill(password)

288 await page.getByRole('button', { name: /sign in/i }).click()

289 await expect(page).not.toHaveURL(/\/login$/)

290}

291EOF

292

293write_if_absent tests/e2e/isolation.spec.ts <<'EOF'

294import { test, expect } from '@playwright/test'

295import { loginAs } from './helpers/auth'

296

297// The single most important security test: confirm User B cannot reach User A's

298// resource, and that the app reveals 404 (not 403 — a 403 leaks that it exists).

299// Add one of these per user-owned resource type. The backend enforces isolation via

300// `userId in WHERE`; this proves the frontend surfaces it correctly.

301//

302// SKIPPED BY DEFAULT: a fresh scaffold has no /login flow or backend, so this would

303// fail CI on day one. Change `test.skip` → `test` (and wire helpers/auth.ts) the moment

304// you ship your first user-owned resource. The PR template makes that a DoD item.

templates/express/scripts/openapi.export.tsView file

Lines 21-61typescript

21import { dirname, resolve } from 'node:path'

22import { fileURLToPath, pathToFileURL } from 'node:url'

23import { OpenApiGeneratorV31, OpenAPIRegistry } from '@asteasolutions/zod-to-openapi'

24import { stringify as yamlStringify } from 'yaml'

templates/express/MakefileView file

•path = templates/express/Makefile kind = build_helper sizeBytes = 2138 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/express/MakefileView on unpkg

templates/express/.claude/hooks/post-write.shView file

•path = templates/express/.claude/hooks/post-write.sh kind = payload_in_excluded_dir sizeBytes = 3091 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/express/.claude/hooks/post-write.shView on unpkg

templates/nestjs/.claude/rules/testing.mdView file

Lines 81-121markdown

81import * as request from 'supertest'

82import { AppModule } from '../src/app.module'

83import { INestApplication, ValidationPipe } from '@nestjs/common'

85describe('ApplicationController (e2e)', () => {

86 let app: INestApplication

87 let token: string

89 beforeAll(async () => {

90 const module = await Test.createTestingModule({

91 imports: [AppModule

Source & flagged code

5 flagged · loading source

templates/nextjs/.claude/scripts/infra-setup.shView file

284patternName = generic_password severity = medium line = 284 matchedText = export a...') {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code