registry / @a4ui/core / 0.8.0

@a4ui/core@0.8.0

A4ui — Spatial Glass design system & component library for SolidJS (Kobalte behavior + Tailwind glass tokens + motion).

AI Security Review

scanned 18h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Import-time behavior is limited to browser UI theme/effect state and DOM classes; no package, agent-config, credential, process, or network mutation is established.

Static reason

No blocking static signals were detected.

Trigger

Importing the UI bundle in a browser initializes theme/effect preferences.

Impact

Changes only browser-local UI preference keys and document styling.

Mechanism

Client-side UI rendering with localStorage-backed visual preferences.

Rationale

Source inspection supports a client-side SolidJS component library, not attack behavior. The AI-agent text is documentation requiring an explicit user copy action and does not write or control agent configuration.

Evidence

package.jsondist/index.jsdist/elements.jsdist/elements.iife.jspreset.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

README.md:121-140 includes AI-agent/AGENTS.md copy-paste guidance; it is inert documentation.
dist/index.js:42-130 performs import-time browser theme/effects initialization using localStorage and document classes.

@a4ui/core@0.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code