Loading npm security reports…

scaffold-agent@0.1.28: Clean npm security report (Allow) | LPM Firewall

registry / scaffold-agent / 0.1.28

scaffold-agent@0.1.28

Interactive CLI to scaffold monorepo projects for onchain AI agents

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The CLI's network and write behavior is disclosed scaffolding and optional 1Claw vault setup initiated by the user.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `scaffold-agent` and supplies/selects 1Claw credentials or accepts project scaffolding.

Impact

Creates the requested project and may store explicitly provided/generated secrets in the selected 1Claw service.

Mechanism

Generate a project, optionally upload selected/generated keys to a configured 1Claw vault, then install generated-project dependencies.

Rationale

The flagged primitives are part of an interactive scaffolder's disclosed project creation and optional named vault integration, not covert collection or execution. No install-time behavior or concrete malicious chain was found by source inspection.

Evidence

package.jsondist/cli.jsdist/secret-add.mjsREADME.md<generated-project>/.env<generated-project>/.env.secrets.encrypted<generated-project>/.claude/settings.json<generated-project>/.cursor/mcp.json

Network endpoints3

api.1claw.xyz/v1/auth/api-key-tokenapi.1claw.xyz/v1/vaultsapi.1claw.xyz/v1/agents

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/cli.js` sends generated/user-provided keys to `https://api.1claw.xyz` only during selected 1Claw vault setup.
`dist/cli.js` runs `npm install` in the newly scaffolded project after an explicit CLI invocation, with skip controls.
`dist/cli.js` writes project-local `.env` and encrypted secret files, and generates project-local `.claude`/`.cursor` configuration.

Evidence against

`package.json` has no install, preinstall, or postinstall hook; `prepublishOnly` only builds before publishing.
`dist/cli.js` prompts for a 1Claw API key or accepts an explicit flag before calling `setupOneClaw`; deferred setup makes no vault request.
Vault requests authenticate to the named 1Claw API and store secrets in explicitly named vault paths; no unrelated host or ambient credential harvesting was found.
No `eval`, VM execution, remote payload loading, persistence outside the generated project, or destructive behavior was found in inspected files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

7 flagged

dist/cli.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3// src/cli.ts

4import { join as join4, dirname as dirname2, resolve as resolve2 } from "path";

5import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";

6import { fileURLToPath as fileURLToPath2 } from "url";

7import { spawn } from "child_process";

8import chalk3 from "chalk";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L6

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L6

9import ora from "ora";

11// src/cli-argv.ts

12import { parseArgs } from "util";

13var SECRETS = ["oneclaw", "encrypted", "none"];

14var LLM = ["oneclaw", "gemini", "openai", "anthropic"];

15var SHROUD_UPSTREAM = [

16 "openai",

17 "anthropic",

18 "google",

19 "gemini",

20 "mistral",

21 "cohere",

22 "openrouter",

23 "darkbloom",

24 "venice"

25];

26var SHROUD_BILLING = [

Lines 1930-1970javascript

1930]);

1931

1932const gen = spawnSync(process.execPath, ["scripts/generate-abi-types.mjs"], {

1933 cwd: root,

1934 stdio: "inherit",

1935 env: process.env,

1936});

1937if (gen.status !==

Lines 2308-2348javascript

2308function getGenerateDeployerScript() {

2309 return `#!/usr/bin/env node

2310import { readFileSync, writeFileSync, existsSync } from "fs";

2311import { join } from "path";

2312import {

2313 decryptSecretsFile,

2314 loadPublicEnvFile,

2315 promptSecretsPassword,

2316 saveSecretsFile,

2317 upsertEnvLine,

Lines 3356-3396javascript

3356 const bytes = randomBytes(len);

3357 let out = "";

3358 for (let i = 0; i < len; i++) out +=

Lines 10241-10281javascript

10241 const exitCode = await new Promise((resolve3) => {

10242 const child = spawn("npm", ["install"], {

Source & flagged code

7 flagged · loading source

dist/cli.jsView file

6import { fileURLToPath as fileURLToPath2 } from "url"; L7: import { spawn } from "child_process"; L8: import chalk3 from "chalk"; ... L241: import { isAddress } from "viem"; L242: import { generatePrivateKey, privateKeyToAccount } from "viem/accounts"; L243: function isValidEthAddress(val) { ... L466: const sessionKeyPrivateKey = await password({ L467: message: "Session key private key (0x..., for AGENT_PRIVATE_KEY):", L468: mask: "*", ... L744: try { L745: raw = JSON.parse(readFileSync(abs, "utf8")); L746: } catch (e) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> dist/cli.js L6: import { fileURLToPath as fileURLToPath2 } from "url"; L7: import { spawn } from "child_process"; L8: import chalk3 from "chalk"; ... L241: import { isAddress } from "viem"; L242: import { generatePrivateKey, privateKeyToAccount } from "viem/accounts"; L243: function isValidEthAddress(val) { ... L466: const sessionKeyPrivateKey = await password({ L467: message: "Session key private key (0x..., for AGENT_PRIVATE_KEY):", L468: mask: "*", ... L744: try { L745: raw = JSON.parse(readFileSync(abs, "utf8")); L746: } catch (e) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L6

Findings

2 Critical4 High4 Medium5 Low

CriticalCredential Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/cli.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

HighRuntime Package Installdist/cli.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/cli.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3// src/cli.ts

4import { join as join4, dirname as dirname2, resolve as resolve2 } from "path";

5import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";

6import { fileURLToPath as fileURLToPath2 } from "url";

7import { spawn } from "child_process";

8import chalk3 from "chalk";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L6

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L6

9import ora from "ora";

11// src/cli-argv.ts

12import { parseArgs } from "util";

13var SECRETS = ["oneclaw", "encrypted", "none"];

14var LLM = ["oneclaw", "gemini", "openai", "anthropic"];

15var SHROUD_UPSTREAM = [

16 "openai",

17 "anthropic",

18 "google",

19 "gemini",

20 "mistral",

21 "cohere",

22 "openrouter",

23 "darkbloom",

24 "venice"

25];

26var SHROUD_BILLING = [

Lines 1930-1970javascript

1930]);

1931

1932const gen = spawnSync(process.execPath, ["scripts/generate-abi-types.mjs"], {

1933 cwd: root,

1934 stdio: "inherit",

1935 env: process.env,

1936});

1937if (gen.status !==

Lines 2308-2348javascript

2308function getGenerateDeployerScript() {

2309 return `#!/usr/bin/env node

2310import { readFileSync, writeFileSync, existsSync } from "fs";

2311import { join } from "path";

2312import {

2313 decryptSecretsFile,

2314 loadPublicEnvFile,

2315 promptSecretsPassword,

2316 saveSecretsFile,

2317 upsertEnvLine,

Lines 3356-3396javascript

3356 const bytes = randomBytes(len);

3357 let out = "";

3358 for (let i = 0; i < len; i++) out +=

Lines 10241-10281javascript

10241 const exitCode = await new Promise((resolve3) => {

10242 const child = spawn("npm", ["install"], {