create-zuplo-api@7.8.15
Create Zuplo API with one command
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is an explicit, opt-in scaffolder that writes Zuplo-owned agent config and unpinned skill files into the project being created. It is not an install hook or a hidden control-surface hijack, so the guarded agent setup warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running create-zuplo-api with --agents or answering the interactive agent prompt.
Impact
The generated project trusts Zuplo docs MCP and mutable main-branch skill text for the agents the user selected. CI and --yes skip this unless --agents is set.
Mechanism
installAgentConfigs writes .mcp.json, instruction files, and Claude plugin settings, then downloads SKILL.md files from https://codeload.github.com/zuplo/tools/tar.gz/main into agent skill directories.
AI rationale
This is an explicit, opt-in scaffolder that writes Zuplo-owned agent config and unpinned skill files into the project being created. It is not an install hook or a hidden control-surface hijack, so the guarded agent setup warrants a warning rather than a block.
Evidence
package.jsondist/index.js.mcp.json.claude/settings.jsonCLAUDE.md.github/copilot-instructions.md.cursorrules.windsurfrulesAGENTS.md.claude/skills.agents/skills.cursor/skills.windsurf/skills
Network endpoints2
codeload.github.com/zuplo/tools/tar.gz/maindev.zuplo.com/mcp/docs
Decision evidence
public snapshotAI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json only publishes a user-run bin and build/test scripts, with no preinstall, install, or postinstall hook.
- Agent files are written only when the create command receives an explicit --agents list or an interactive multiselect; CI and --yes leave the list empty.
- A non-empty selection writes .mcp.json for the Zuplo docs MCP and Claude settings that enable zuplo-tools marketplace plugins and all project MCP servers.
- Non-Claude selections also download SKILL.md files from the unpinned zuplo/tools main tarball into the new project's agent skill directories.
Evidence against
- Nothing runs on npm install; the user must invoke the create command.
- The prompt includes a None choice, and CI or --yes does not select agents by default.
- The MCP URL and skill source are Zuplo project endpoints, and the writes target the project the user is scaffolding.
- No credential harvesting, install-time persistence, or self-dependency chain is present.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
8 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: missingProperty: ${g},
L7: depsCount: ${u},
L8: deps: ${
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L11Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: m
Findings
2 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to create-zuplo-api@7.8.15.
See all versions of create-zuplo-api for other recorded verdicts.
- Review the evidence and your use of create-zuplo-api@7.8.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.